CWE-286 Incorrect User Management
classThe product does not properly manage a user within its environment.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (41)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-64725US | critical9.8 | — | ||
Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workar… | ||||
| CVE-2025-59943US | critical9.8 | — | ||
phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses during user registration. This allows multipl… | ||||
| CVE-2024-46671US | high7.2 | Exploit | ||
An Incorrect User Management vulnerability [CWE-286] in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashbo… | ||||
| CVE-2022-32260US | critical9.8 | — | ||
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). The affected application creates temporary user credentials for UMC (User Management… | ||||
| CVE-2025-7972US | critical9.1 | — | ||
A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This by… | ||||
| CVE-2024-52359US | high8.8 | — | ||
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions that should be reserved to administrator used due to imprope… | ||||
| CVE-2023-3907US | high8.8 | — | ||
A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to us… | ||||
| CVE-2021-21553US | high8.8 | — | ||
Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific conditions, this can allow the CompAdmin user to elevate privilege… | ||||
| CVE-2024-28020US | high8.0 | — | ||
A user/password reuse vulnerability exists in the FOXMAN-UN/UNEM application
and server management. If exploited a malicious high-privileged
user could use the passwords and login… | ||||
| CVE-2024-58105US | high7.8 | — | ||
A vulnerability in the Trend Micro Apex One Security Agent Plug-in User Interface Manager could allow a local attacker to bypass existing security and execute arbitrary code on af… | ||||
| CVE-2023-25519US | high7.8 | — | ||
NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrect user management error. A successful ex… | ||||
| CVE-2023-0857US | high7.5 | — | ||
Unintentional change of settings during initial registration of system administrators which uses control protocols. The affected Office / Small Office Multifunction Printers and La… | ||||
| CVE-2022-45857US | high7.5 | — | ||
An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attacker to access a FortiGate without a passw… | ||||
| CVE-2015-6607US | medium6.8 | — | ||
SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586. | ||||
| CVE-2024-45425US | medium6.5 | — | ||
Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. | ||||
| CVE-2024-9312US | medium6.4 | — | ||
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain the… | ||||
| CVE-2023-3932US | medium6.5OT elevated | — | ||
An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 b… | ||||
| CVE-2024-13041US | medium5.4 | — | ||
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When… | ||||
| CVE-2023-20253US | medium5.5 | — | ||
A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authenticated, local attacker to bypass authorization and allow the… | ||||
| CVE-2021-26262US | medium5.5 | — | ||
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor. | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan