CWE-566

10 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 2High 3Medium 1Low 4Not scored 0

CVEs per yearBy the year they were published

CVE-2026-85749
MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
mailwatch · MailWatch
High8.1
CVE-2026-84650
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit…
Jenkins Project · Jenkins
High8.8
CVE-2026-21886
OpenCTI's GraphQL Mutations Allow Deletion of Unrelated Entities
OpenCTI-Platform · opencti
Medium6.5
CVE-2025-9953
SQLi in Database Software's Databank Accreditation Software
DATABASE Software Training Consulting Ltd. · Databank Accreditation Software
Critical9.8
CVE-2025-61781
GraphQL IDOR allows authenticated user to delete workspace content of other users
OpenCTI-Platform · opencti
High7.1
CVE-2025-56556
An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the…
Product not named
Low3.8
CVE-2025-30369
Zulip allows the deletion of Custom profile fields by administrators of a different organization
zulip · zulip
Low2.7
CVE-2025-30368
Zulip allows the deletion of organization by administrators of a different organization
zulip · zulip
Low2.7
CVE-2024-22261
SQL Injection in Harbor scan log API
Harbor · Harbor
Low2.7
CVE-2014-0808
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this…
EC-CUBE CO.,LTD. · EC-CUBE
Critical9.1