CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
variantThe product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (9)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-61781US | critical9.1OT elevated | — | ||
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePopoverDeletionMutation"… | ||||
| CVE-2026-21886US | high8.1 | — | ||
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation… | ||||
| CVE-2024-22261US | medium5.5 | — | ||
SQL-Injection in Harbor allows priviledge users to leak the task IDs | ||||
| CVE-2014-0808US | medium5.0 | — | ||
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is explo… | ||||
| CVE-2026-84650US | — | — | ||
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify… | ||||
| CVE-2025-9953US | — | — | ||
Authorization Bypass Through User-Controlled SQL Primary Key vulnerability in DATABASE Software Training Consulting Ltd. Databank Accreditation Software allows SQL Injection.
This… | ||||
| CVE-2025-56556US | — | — | ||
An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel -… | ||||
| CVE-2025-30369US | — | — | ||
Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization administrators, but its hand… | ||||
| CVE-2025-30368US | — | — | ||
Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization administrators, but its handler failed to… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan