CWE-648: CWE-648
Yearly Trend
Top Affected Vendors
All CWE-648 CVEs (16)
This vulnerability allows remote unauthenticated attackers to modify registry values in WhatsUp Gold installations, potentially enabling system compro...
Dec 2, 2024CVE-2024-11068 is a critical vulnerability in D-Link DSL6740C modems that allows unauthenticated remote attackers to change any user's password via AP...
Nov 11, 2024This vulnerability in Yepas Digital Yepas involves incorrect use of privileged APIs, allowing attackers to collect data as provided by users. It affec...
Sep 14, 2023This vulnerability involves incorrect use of privileged APIs in the trudesk help desk software, allowing attackers to execute arbitrary code with elev...
Jun 20, 2022CVE-2024-37018 is a topology poisoning vulnerability in OpenDaylight SDN controllers that allows malicious applications to manipulate network discover...
May 31, 2024This vulnerability in XWiki Commons allows attackers to manipulate document authorship through the Document script API, bypassing access controls. Thi...
Apr 16, 2023This vulnerability in Cisco Catalyst SD-WAN Manager allows authenticated local users with low privileges to escalate to root privileges through the RE...
Feb 25, 2026A local privilege escalation vulnerability exists in Siemens Spectrum Power 4 due to an exposed debug interface on localhost. This allows any local us...
Nov 11, 2025This vulnerability in ESKOM Computer's e-municipality module allows attackers to misuse privileged APIs to collect user-provided data. It affects all ...
Nov 28, 2023This vulnerability allows attackers to escalate privileges by exploiting incorrect use of privileged APIs in NomySoft's Nomysem software. It affects a...
Dec 10, 2025A vulnerability in Whale browser's Web Request API allowed malicious extensions to block access to the extension store or redirect users to arbitrary ...
Mar 17, 2022Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw where authenticated users with custom permissions limited to task access can...
Feb 9, 2026An authenticated read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user. This allows denial of se...
Jul 29, 2025This vulnerability in XWiki Platform allows any authenticated user to manipulate another user's notification filter preferences by knowing the filter ...
Sep 18, 2024This vulnerability allows authenticated users of Bentley Systems ProjectWise Integration Server to execute unintended SQL queries through API calls. T...
Jan 31, 2025This vulnerability allows authenticated read-only users to access an administrative API endpoint for importing appliance configurations. Attackers can...
Jul 29, 2025About CWE-648 (CWE-648)
Our database tracks 16 CVEs classified as CWE-648, with 6 rated critical and 5 rated high severity. The average CVSS score for CWE-648 vulnerabilities is 7.9.
External reference: View CWE-648 on MITRE CWE →
Monitor CWE-648 Vulnerabilities
Get alerted when new CWE-648 CVEs affect your infrastructure.
Start Monitoring Free