Base de CVEs

CVE-2025-6042 Alta · 7.3 CWE-269 15/10/2025

Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Unauthenticated Privilege Escalation to Editor

The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.0. This is due to the plugin assigning the editor role by default. While limitations with respect to capabilities are put in place, use of the API is not restricted. This vulnerability can be leveraged together with CVE-2025-6038 to obtain admin privileges.

CVE-2025-56747 Média · 6.5 CWE-269 14/10/2025

Improper Privilege Management em Creativeitem Academy Lms

Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_instructor controller where regular authenticated users can access instructor-only functions without proper role validation, allowing unauthorized course creation and management.

CVE-2025-9068 Alta · 7.8 CWE-269 14/10/2025

Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities

A security issue exists within the Rockwell Automation Driver Package x64 Microsoft Installer File (MSI) repair functionality, installed with FTLinx. Authenticated attackers with valid Windows Users credentials can initiate a repair and hijack the resulting console window for vbpinstall.exe. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources.

CVE-2025-9067 Alta · 7.8 CWE-269 14/10/2025

Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities

A security issue exists within the x86 Microsoft Installer File (MSI), installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair and hijack the resulting console window. This allows the launching of a command prompt running with SYSTEM-level privileges, allowing full access to all files, processes, and system resources.

CVE-2025-11533 Crítica · 9.8 CWE-269 11/10/2025

WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation

The WP Freeio plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.21. This is due to the process_register() function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.

CVE-2025-59247 Crítica · 9.8 CWE-269 09/10/2025

Azure PlayFab Elevation of Privilege Vulnerability

CVE-2025-61786 Baixa · 3.3 CWE-269 07/10/2025

Deno's --deny-read check does not prevent permission bypass

Deno is a JavaScript, TypeScript, and WebAssembly runtime. In versions prior to 2.5.3 and 2.2.15, `Deno.FsFile.prototype.stat` and `Deno.FsFile.prototype.statSync` are not limited by the permission model check `--deny-read=./`. It's possible to retrieve stats from files that the user do not have explicit read access to (the script is executed with `--deny-read=./`). Similar APIs like `Deno.stat` and `Deno.statSync` require `allow-read` permission, however, when a file is opened, even with file-write only flags and deny-read permission, it's still possible to retrieve file stats, and thus bypass the permission model. Versions 2.5.3 and 2.2.15 fix the issue.

CVE-2025-34251 Alta · 8.6 CWE-269 06/10/2025

Tesla Telematics Control Unit (TCU) < v2025.14 Authentication Bypass

Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges.

CVE-2025-10578 Alta · 7.8 CWE-269 01/10/2025

HP Support Assistant - Potential Escalation of Privilege

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write.

CVE-2025-10657 Alta · 8.7 CWE-269 26/09/2025

Docker Desktop with ECI Fails to Enforce Socket Command Restrictions

In a hardened Docker environment, with Enhanced Container Isolation ( ECI https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/ ) enabled, an administrator can utilize the command restrictions feature https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/config/#command-restrictions to restrict commands that a container with a Docker socket mount may issue on that socket. Due to a software bug, the configuration to restrict commands was ignored when passed to ECI, allowing any command to be executed on the socket. This grants excessive privileges by permitting unrestricted access to powerful Docker commands. The vulnerability affects only Docker Desktop 4.46.0 users that have ECI enabled and are using the Docker socket command restrictions feature. In addition, since ECI restricts mounting the Docker socket into containers by default, it only affects containers which are explicitly allowed by the administrator to mount the Docker socket.

CVE-2025-5494 Alta · 7.8 CWE-269 25/09/2025

Privilege Escalation

ZohoCorp ManageEngine Endpoint Central was impacted by an improper privilege management issue in the agent setup. This issue affects Endpoint Central: through 11.4.2500.25, through 11.4.2508.13.

CVE-2025-9966 Alta · 7.3 CWE-269 23/09/2025

Execution with Unnecessary Privileges

Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).

CVE-2025-34204 Crítica · 9.8 CWE-269 19/09/2025

Vasion Print (formerly PrinterLogic) Processes Running as Root Inside Docker Instances

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) contains multiple Docker containers that run primary application processes (for example PHP workers, Node.js servers and custom binaries) as the root user. This increases the blast radius of a container compromise and enables lateral movement and host compromise when a container is breached.

CVE-2025-52915 Alta · 7.2 CWE-269 09/09/2025

K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged...

K7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged user to send crafted IOCTL requests to terminate processes that are protected through a third-party implementation. This is caused by insufficient caller validation in the driver's IOCTL handler, enabling unauthorized processes to perform those actions in kernel space. Successful exploitation can lead to denial of service by disrupting critical third-party services or applications.

CVE-2025-40594 Crítica · 9.8 CWE-269 09/09/2025

A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS...

A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 HF2), SINAMICS S200 V6.4 (All versions < V6.4 HF7), SINAMICS S210 V6.4 (All versions < V6.4 HF2). The affected devices allow a factory reset to be executed without the required privileges due to improper privilege management as well as manipulation of configuration data because of leaked privileges of previous sessions. This could allow an unauthorized attacker to escalate their privileges.

CVE-2024-11218 Alta · 8.6 CWE-269 22/01/2025

Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

CVE-2024-49035 Crítica · 9.8 KEV Alta · 56 CWE-269 26/11/2024

Microsoft Partner Center Improper Access Control Vulnerability

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.

CVE-2024-31141 Média · 6.5 CWE-269 19/11/2024

Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products. This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0. Users with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property "org.apache.kafka.automatic.config.providers=none". Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate "allowlist.pattern" and "allowed.paths" to restrict their operation to appropriate bounds. For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property. For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.

CVE-2024-8068 Alta · 8.0 KEV Alta · 60 Exploit público CWE-269 12/11/2024

Citrix Session Recording Improper Privilege Management Vulnerability

Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Windows Active Directory domain as the session recording server domain

CVE-2024-38014 Alta · 7.8 KEV Alta · 55 CWE-269 10/09/2024

Microsoft Windows Installer Improper Privilege Management Vulnerability

Windows Installer Elevation of Privilege Vulnerability

CVE-2024-26169 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-269 12/03/2024

Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2023-45581 Alta · 7.2 CWE-269 15/02/2024

An improper privilege management vulnerability [CWE-269] in Fortinet FortiClientEMS version 7.2.0...

An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.

CVE-2023-35674 Alta · 7.8 KEV Alta · 60 Exploit público CWE-269 11/09/2023

Android Framework Privilege Escalation Vulnerability

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-28434 Alta · 8.8 KEV Alta · 61 Exploit público CWE-269 22/03/2023

Bypass de Gerenciamento de Privilégios no MinIO (PostPolicyBucket)

Minio é um framework de armazenamento de objetos multi-nuvem. Antes de RELEASE.2023-03-20T20-16-18Z, um atacante pode usar requisições elaboradas para contornar a verificação de nome de bucket nos metadados e inserir um objeto em qualquer bucket durante o processamento de `PostPolicyBucket`. Para executar esse ataque, o atacante precisa de credenciais com a permissão `arn:aws:s3:::*`, além de acesso à API do Console habilitado. Este problema foi corrigido em RELEASE.2023-03-20T20-16-18Z. Como solução alternativa, habilite o acesso à API do navegador e desative `MINIO_BROWSER=off`.

CVE-2023-26604 Alta · 7.8 CWE-269 03/03/2023

systemd before 247 does not adequately block local privilege escalation for some Sudo...

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.