CWE-269 관련 취약점
같은 약점 유형으로 분류된 취약점입니다. CWE 는 "무엇을 잘못했는가" 의 분류이고, 제품을 가리지 않고 같은 실수가 반복됩니다.
CWE-269 — 주요 취약점
악용이 확인된 것을 먼저 보여줍니다.
● 실제 악용이 확인됨CVE-2017-5689An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKU…92.2%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2021-20021A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an adm…88.8%심각9.8● 랜섬웨어 캠페인에 사용됨CVE-2016-0151The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and …62.8%높음7.8● 실제 악용이 확인됨CVE-2020-8655An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege esca…60.1%높음7.8● 랜섬웨어 캠페인에 사용됨CVE-2019-1405An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) servi…30.2%높음7.8● 랜섬웨어 캠페인에 사용됨CVE-2019-1215An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects…19.3%높음7.8● 실제 악용이 확인됨CVE-2026-46817Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmissio…12.3%심각9.8● 실제 악용이 확인됨CVE-2013-0643The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows…10.5%높음8.8
전체 목록
120건
CVE-2019-1388랜섬웨어 악용An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enf…8.6%높음7.8
CVE-2023-28434악용 확인Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use cr…7.9%높음8.8
CVE-2020-3950악용 확인VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon C…7.3%높음7.8
CVE-2002-0367악용 확인smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that conne…4.9%높음7.8
CVE-2026-21533악용 확인Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges lo…4.2%높음7.8
CVE-2024-8068악용 확인Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authe…3.5%보통5.1
CVE-2021-25337악용 확인Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows …2.8%높음7.1
CVE-2023-35674악용 확인In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error …2.6%높음7.8
CVE-2024-49035악용 확인An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elev…1.3%심각9.8
CVE-2021-23874악용 확인Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local use…1.0%높음7.8
CVE-2026-84869악용 확인A condition in the ScreenConnect client may allow files to be transferred and executed through an active remot…0.9%심각9.9
CVE-2026-12269Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerabilit…7.0%높음8.8
CVE-2026-84830SEPPmail Secure Email Gateway before 15.0.7 contains a command injection vulnerability that allows authenticat…1.1%높음8.6
CVE-2026-85979Affected versions of Puppet Enterprise contain a command injection vulnerability in the handling of the java_k…1.0%높음8.6
CVE-2026-104798The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all v…0.9%심각9.8
CVE-2026-120338Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, …0.8%심각10.0
CVE-2026-61781pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, create_par…0.8%심각9.9
CVE-2026-96044No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over …0.7%높음8.8
CVE-2026-104748The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is …0.6%심각9.8
CVE-2026-77524KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace admi…0.6%심각9.9
CVE-2026-92619The Booking Calendar plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and inc…0.7%높음7.2
CVE-2026-104018An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 w…0.6%높음8.8
CVE-2026-111708WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthe…0.6%심각9.3
CVE-2026-76742Authentication bypass vulnerabilities exist in the web management interface of AOS-S. Successful exploitation …0.6%심각9.8
CVE-2026-66818Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network…0.6%높음8.8
CVE-2026-104749The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPre…0.5%높음7.5
CVE-2026-76713A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Succes…0.6%높음7.2
CVE-2026-113947This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unp…0.5%높음8.8
CVE-2026-67269Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Managem…0.5%심각9.9
CVE-2026-104745The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via…0.5%높음8.1
CVE-2026-14281The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPres…0.5%심각9.8
CVE-2026-59797Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related ex…0.5%심각9.8
CVE-2026-86553SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime p…0.5%높음8.8
CVE-2026-76801The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPres…0.5%높음8.8
CVE-2026-94609authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with dele…0.5%높음8.8
CVE-2026-92957vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negati…0.5%심각9.4
CVE-2026-90523A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d…0.5%보통5.5
CVE-2026-97644The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Es…0.5%높음8.8
CVE-2026-118205The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable …0.5%높음7.4
CVE-2026-117468Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when …0.5%보통6.5
CVE-2026-105126LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated A…0.5%높음8.6
CVE-2026-73470Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Role…0.5%심각9.8
CVE-2026-73802Gitea Runner passes workflow-controlled container options into Docker job container configuration while privil…0.5%미평가
CVE-2026-48826HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/h…0.5%높음8.1
CVE-2026-81445Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vu…0.5%높음7.2
CVE-2026-95687The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via acco…0.5%높음8.8
CVE-2026-101860A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginIn…0.5%높음7.4
CVE-2026-89426The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege …0.5%높음8.8
CVE-2026-65831ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database}…0.4%높음7.7
CVE-2026-76554The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is pe…0.5%높음7.2
CVE-2026-92541The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users cap…0.5%높음7.2
CVE-2026-92540The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote…0.5%높음7.2
CVE-2026-81810The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on …0.5%높음7.2
CVE-2026-109381The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and includin…0.4%높음7.2
CVE-2026-17553The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5…0.4%높음7.2
CVE-2026-85955Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker …0.4%심각9.9
CVE-2026-102676Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior …0.5%높음8.3
CVE-2026-109515The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPres…0.4%심각9.8
CVE-2026-85569The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addres…0.4%높음7.2
CVE-2026-93968A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file bac…0.4%보통5.1
CVE-2026-75160An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoint…0.4%심각9.1
CVE-2026-13355The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to…0.4%심각9.8
CVE-2026-58255Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-a…0.4%높음8.8
CVE-2026-76694A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN…0.4%보통6.6
CVE-2025-71421UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent en…0.4%높음8.6
CVE-2026-54168Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior…0.4%보통6.5
CVE-2026-75983The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable …0.4%높음7.5
CVE-2026-94047A security vulnerability has been detected in samanhappy MCPHub up to 1.0.32. The impacted element is the func…0.4%낮음2.1
CVE-2026-109927The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that…0.4%높음7.2
CVE-2026-90787A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Af…0.4%보통5.5
CVE-2026-12793The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in…0.4%심각9.8
CVE-2026-110018The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin…0.4%높음8.8
CVE-2026-116162Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privile…0.4%낮음2.1
CVE-2026-86153A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEn…0.4%심각9.4
CVE-2026-110523The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions…0.4%높음8.1
CVE-2026-81442Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vu…0.4%높음8.1
CVE-2026-94048A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function …0.4%낮음2.0
CVE-2026-18467The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in al…0.4%심각9.8
CVE-2026-37107An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the adm…0.4%심각9.8
CVE-2026-110744A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role…0.4%높음7.2
CVE-2026-19807The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in a…0.4%높음8.8
CVE-2026-120306Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Bu…0.4%심각9.9
CVE-2026-61850Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, t…0.4%심각9.3
CVE-2026-86814The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownershi…0.4%높음8.1
CVE-2026-85530The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between t…0.4%높음8.1
CVE-2026-17645IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to ga…0.4%심각9.1
CVE-2026-85659The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions…0.4%높음8.8
CVE-2026-118008Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunder…0.4%높음8.8
CVE-2026-82842The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an …0.4%높음8.1
CVE-2026-108825A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed …0.4%낮음2.1
CVE-2026-94381MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read…0.4%높음8.7
CVE-2026-25784Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container i…0.3%심각9.3
CVE-2026-109317Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user ma…0.4%높음8.6
CVE-2026-113616The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the reso…0.3%심각9.8
CVE-2026-85154WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expir…0.3%심각9.3
CVE-2026-111577The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMT…0.3%높음7.2
CVE-2026-75927The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin fo…0.3%높음7.2
CVE-2026-78362The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied w…0.3%심각9.8
CVE-2026-109400The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalatio…0.4%높음7.5
CVE-2026-86552SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With…0.4%보통5.4
CVE-2026-92975The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Es…0.4%높음8.1
CVE-2026-116223A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file …0.3%보통5.5
CVE-2026-86393Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0…0.3%높음7.2
CVE-2026-87068The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere…0.4%보통6.6
CVE-2026-85948Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery inject…0.3%심각9.9
CVE-2026-85947Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization…0.3%심각9.9
CVE-2026-111982The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the s…0.3%높음7.2
CVE-2026-104767The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Pri…0.3%높음7.5
CVE-2026-85118The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check…0.3%심각9.8
CVE-2026-103692The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on acti…0.3%심각9.8
이 원장은 전체 CVE 가 아닙니다. NVD 에는 30만 건이 넘습니다. 여기 있는 것은 ① 악용이 확인된 것 ② 최근 공개된 것 ③ 국산 SW 관련 ④ KISA 권고에 등장한 것입니다. 무엇을 담았는지 밝히지 않으면 "없다" 를 "안전하다" 로 읽게 됩니다.