Filtered by CWE-266
Filtered by vendor Subscriptions
Total 896 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-50481 1 Stack Themes 1 Bstone Demo Importer 2026-04-23 8.8 High
Incorrect Privilege Assignment vulnerability in stackthemes Bstone Demo Importer bstone-demo-importer allows Privilege Escalation.This issue affects Bstone Demo Importer: from n/a through <= 1.0.1.
CVE-2024-49644 2026-04-23 8.8 High
Incorrect Privilege Assignment vulnerability in AllAccessible Accessibility by AllAccessible allaccessible allows Privilege Escalation.This issue affects Accessibility by AllAccessible: from n/a through <= 1.3.4.
CVE-2024-49608 1 Gerryntabuhashe 1 Gerryworks Post By Mail 2026-04-23 8.8 High
Incorrect Privilege Assignment vulnerability in gerryworks GERRYWORKS Post by Mail gerryworks-post-by-mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through <= 1.0.
CVE-2024-43153 1 Xtendify 1 Woffice 2026-04-23 9.8 Critical
Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10.
CVE-2024-35700 1 Userproplugin 1 Userpro 2026-04-23 9.8 Critical
Incorrect Privilege Assignment vulnerability in DeluxeThemes Userpro userpro.This issue affects Userpro: from n/a through <= 5.1.8.
CVE-2024-32959 2 Sirv, Wordpress 2 Sirv, Wordpress 2026-04-23 8.8 High
Incorrect Privilege Assignment vulnerability in Sirv CDN and Image Hosting Sirv sirv.This issue affects Sirv: from n/a through <= 7.2.2.
CVE-2024-32555 1 Wordpress 1 Wordpress 2026-04-23 9.8 Critical
Incorrect Privilege Assignment vulnerability in InspiryThemes Easy Real Estate easy-real-estate allows Privilege Escalation.This issue affects Easy Real Estate: from n/a through <= 2.2.9.
CVE-2024-32507 2026-04-23 8.8 High
Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.16.
CVE-2024-32444 2 Inspirythemes, Wordpress 2 Realhomes, Wordpress 2026-04-23 9.8 Critical
Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.3.6.
CVE-2024-28000 1 Litespeedtech 1 Litespeed Cache 2026-04-23 9.8 Critical
Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1.
CVE-2024-22145 1 Instawp 1 Instawp Connect 2026-04-23 8.8 High
Incorrect Privilege Assignment vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.8.
CVE-2026-33519 1 Esri 1 Portal For Arcgis 2026-04-23 9.8 Critical
An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 12.0 on Windows, Linux and Kubernetes that did not correctly check permissions assigned to developer credentials.
CVE-2026-33518 1 Esri 1 Portal For Arcgis 2026-04-23 9.8 Critical
An incorrect privilege assignment vulnerability exists in Esri Portal for ArcGIS 11.5 in Windows and Linux that allows highly privileged users to create developer credentials that may grant more privileges than expected.
CVE-2026-6769 1 Mozilla 2 Firefox, Thunderbird 2026-04-23 8.8 High
Privilege escalation in the Debugger component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-6761 1 Mozilla 2 Firefox, Thunderbird 2026-04-23 8.8 High
Privilege escalation in the Networking component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
CVE-2026-4013 1 Sourcecodester 1 Web-based Pharmacy Product Management System 2026-04-23 6.3 Medium
A vulnerability was identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown function of the file add_admin.php. Such manipulation leads to improper authorization. The attack may be launched remotely.
CVE-2026-3668 1 Freedom Factory 1 Dgen1 2026-04-23 3.1 Low
A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-3667 1 Freedom Factory 1 Dgen1 2026-04-23 5.3 Medium
A security flaw has been discovered in Freedom Factory dGEN1 up to 20260221. The impacted element is the function FakeAppService of the component org.ethosmobile.ethoslauncher. The manipulation results in improper authorization. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-3675 1 Freedom Factory 1 Dgen1 2026-04-23 5.3 Medium
A vulnerability was determined in Freedom Factory dGEN1 up to 20260221. Affected by this issue is the function FakeAppReceiver of the component org.ethosmobile.ethoslauncher. Executing a manipulation can lead to improper authorization. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-3669 1 Freedom Factory 1 Dgen1 2026-04-23 5.3 Medium
A security vulnerability has been detected in Freedom Factory dGEN1 up to 20260221. This impacts the function AlarmService of the component com.dgen.alarm. Such manipulation leads to improper authorization. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.