CWE-566 · 7 records

Authorization Bypass Through User-Controlled SQL Primary Key

CVEs in this class

7 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2025-9953No exploit	SQLi in Database Software's Databank Accreditation Softwaredatabase software training consulting ltd. · databank accreditation software · CWE-566 Pre-auth SQL injection	Critical9.8	—	0.3%	Feb 19, 2026
37Monitor	CVE-2014-0808No exploit	Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29lockon · ec-cube · CWE-566 Pre-auth	Critical9.1	—	2.2%	Jan 22, 2014
32Monitor	CVE-2026-85749No exploit	MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mailmailwatch · mailwatch · CWE-566 Broken access control (IDOR) CSRF	High8.1	—	0.2%	3 days ago
22Monitor	CVE-2024-22261No exploit	SQL Injection in Harbor scan log APIlinuxfoundation · harbor · CWE-566 SQL injection	Medium5.5	—	0.4%	Jun 10, 2024
15Monitor	CVE-2025-56556No exploit	An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query fintelliants · subrion cms · CWE-566	Low3.8	—	0.2%	Sep 11, 2025
10Monitor	CVE-2025-30368No exploit	Zulip allows the deletion of organization by administrators of a different organizationzulip · zulip · CWE-566	Low2.7	—	0.3%	Mar 31, 2025
10Monitor	CVE-2025-30369No exploit	Zulip allows the deletion of Custom profile fields by administrators of a different organizationzulip · zulip server · CWE-566	Low2.7	—	0.2%	Mar 31, 2025

CVE-2025-9953
39Monitor
SQLi in Database Software's Databank Accreditation Software
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
database software training consulting ltd. · databank accreditation softwareFeb 19, 2026
CVE-2014-0808
37Monitor
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29
CriticalCVSS 9.1No exploitEPSS 2%
- Pre-auth
lockon · ec-cubeJan 22, 2014
CVE-2026-85749
32Monitor
MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
- CSRF
mailwatch · mailwatch3 days ago
CVE-2024-22261
22Monitor
SQL Injection in Harbor scan log API
MediumCVSS 5.5No exploitEPSS 0%
- SQL injection
linuxfoundation · harborJun 10, 2024
CVE-2025-56556
15Monitor
An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query f
LowCVSS 3.8No exploitEPSS 0%
intelliants · subrion cmsSep 11, 2025
CVE-2025-30368
10Monitor
Zulip allows the deletion of organization by administrators of a different organization
LowCVSS 2.7No exploitEPSS 0%
zulip · zulipMar 31, 2025
CVE-2025-30369
10Monitor
Zulip allows the deletion of Custom profile fields by administrators of a different organization
LowCVSS 2.7No exploitEPSS 0%
zulip · zulip serverMar 31, 2025