CWE-250 Execution with Unnecessary Privileges
baseThe product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (602)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-40602US | —OT critical | KEV | ||
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). | ||||
| CVE-2024-38813US | critical9.8OT critical | KEV | ||
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to r… | ||||
| CVE-2019-0211US | high7.8OT critical | KEV | ||
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by… | ||||
| CVE-2025-12420US | critical9.8 | Exploit | ||
A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the imperson… | ||||
| CVE-2024-1222US | critical9.8 | — | ||
This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. This applies to a small subset of PaperCut NG/M… | ||||
| CVE-2000-0506US | high10.0 | Exploit | ||
The "capabilities" feature in Linux before 2.2.16 allows local users to cause a denial of service or gain privileges by setting the capabilities to prevent a setuid program from dr… | ||||
| CVE-2004-2359US | high10.0 | Exploit | ||
Dell TrueMobile 1300 WLAN Mini-PCI Card Util TrayApplet 3.10.39.0 does not properly drop SYSTEM privileges when started from the systray applet, which allows local users to gain pr… | ||||
| CVE-2026-41900US | critical10.0 | Exploit | ||
OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to version 2.0.3, a remote code execution (RCE) vulnerability was identified in the OpenLearnX c… | ||||
| CVE-2018-8897US | high7.8 | Exploit | ||
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-sys… | ||||
| CVE-1999-0412US | high7.5 | Exploit | ||
In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension. | ||||
| CVE-1999-0082US | high10.0 | — | ||
CWD ~root command in ftpd allows root access. | ||||
| CVE-2025-34515US | critical9.8 | — | ||
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in sync_project.sh that allows an attacker to escalate privile… | ||||
| CVE-2021-1480US | high7.8 | Exploit | ||
Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to execute arbitrary code or allow an authenticated, local attacker to gai… | ||||
| CVE-2021-27365US | high7.8 | Exploit | ||
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value.… | ||||
| CVE-1999-0581US | high10.0 | — | ||
The HKEY_CLASSES_ROOT key in a Windows NT system has inappropriate, system-critical permissions. | ||||
| CVE-2025-43990US | high7.8 | Exploit | ||
Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potenti… | ||||
| CVE-2023-27010US | high7.8 | Exploit | ||
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability allows attackers to escalate privileges via modifying or overwr… | ||||
| CVE-2020-14386US | high7.8 | Exploit | ||
A flaw was found in the Linux kernel before 5.9-rc4. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerabil… | ||||
| CVE-2019-16784US | high7.8 | Exploit | ||
In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode… | ||||
| CVE-2019-18862US | high7.8 | Exploit | ||
maidag in GNU Mailutils before 3.8 is installed setuid and allows local privilege escalation in the url mode. | ||||
03
attack patterns (3)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan