Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Authentication Bypass

This page lists 844 vulnerabilities in this category.

Critical: 30 High: 808 Medium: 6
Vulnerability Name
CVE
CWE
Severity
Cisco IOS XE Web UI Authentication Bypass (CVE-2023-20198)
CVE-2023-20198
CWE-287
Critical
SharePoint Authentication bypass (CVE-2023-29357)
CVE-2023-29357
CWE-287
Critical
TeamCity Authentication Bypass (CVE-2023-42793)
CVE-2023-42793
CWE-287
Critical
Jira Seraph Authentication Bypass (CVE-2022-0540)
CVE-2022-0540
CWE-288
Critical
CData Jetty Path Traversal (CVE-2024-31848/CVE-2024-31849/CVE-2024-31850/CVE-2024-31851)
CVE-2024-31851
CWE-22
Critical
Cacti Unauthenticated Command Injection (CVE-2022-46169)
CVE-2022-46169
CWE-77
Critical
CloudPanel file-manager Auth bypass (CVE-2023-35885)
CVE-2023-35885
CWE-565
Critical
CyberPanel RCE (CVE-2024-51567/CVE-2024-51568/CVE-2024-51378)
CVE-2024-51378
CWE-306
Critical
Flowise Authentication Bypass (CVE-2024-31621)
CVE-2024-31621
CWE-287
Critical
GoAnywhere MFT Authentication Bypass (CVE-2024-0204)
CVE-2024-0204
CWE-425
Critical
Ivanti Sentry Authentication Bypass (CVE-2023-38035)
CVE-2023-38035
CWE-863
Critical
Ivanti vTM Auth bypass (CVE-2024-7593)
CVE-2024-7593
CWE-287
Critical
Apache OFBiz Authentication Bypass (CVE-2023-51467)
CVE-2023-51467
CWE-287
Critical
Apache OFBiz RCE (CVE-2024-32113/CVE-2024-36104/CVE-2024-38856)
CVE-2024-38856
CWE-22
Critical
Apache OFBiz RCE (CVE-2024-45195)
CVE-2024-45195
CWE-425
Critical
OpenMetadata Authentication Bypass (CVE-2024-28255)
CVE-2024-28255
CWE-287
Critical
Palo Alto PAN-OS Management Interface Auth Bypass (CVE-2024-0012/CVE-2024-9474)
CVE-2024-9474
CWE-306
Critical
Telerik Report Server Authentication Bypass Vulnerability
CVE-2024-4358
CWE-287
Critical
ScreenConnect Auth bypass (CVE-2024-1709)
CVE-2024-1708
CWE-288
Critical
SolarWinds Web Help Desk Hardcoded Credential (CVE-2024-28987)
CVE-2024-28987
CWE-798
Critical
TeamCity Authentication Bypass (CVE-2024-27198)
CVE-2024-27198
CWE-288
Critical
Adobe Commerce/Magento "SessionReaper" RCE (CVE-2025-54236)
CVE-2025-54236
CWE-20
Critical
CrushFTP Authentication Bypass (CVE-2025-2825)
CVE-2025-2825
CWE-287
Critical
FortiWeb Authentication Bypass (CVE-2025-64446)
CVE-2025-58034
CWE-23
Critical
Kentico Staging API Authentication Bypass
CVE-2025-2746
CWE-287
Critical
Oracle Identity Manager Authentication Bypass (CVE-2025-61757)
CVE-2025-61757
CWE-306
Critical
PAN-OS Management Interface Authentication Bypass (CVE-2025-0108)
CVE-2025-0108
CWE-287
Critical
SharePoint "ToolShell" RCE (CVE-2025-49704/CVE-2025-49706/CVE-2025-53770/CVE-2025-53771)
CVE-2025-53771
CWE-287
Critical
Wing FTP Server RCE (CVE-2025-47812)
CVE-2025-47812
CWE-158
Critical
SmarterTools SmarterMail Admin Password Reset (CVE-2026-23760)
CVE-2026-23760
CWE-288
Critical
Microsoft ASP.NET Forms authentication bypass
CVE-2011-3416
CWE-287
High
Microsoft IIS WebDAV authentication bypass
CVE-2009-1535
CWE-287
High
Microsoft IIS5 NTLM and Basic authentication bypass
CVE-2007-2815
CWE-288
High
Akeeba backup access control bypass
-
CWE-287
High
Adobe ColdFusion 9 administrative login bypass
CVE-2013-0632
CWE-287
High
Security update: Hotfix available for ColdFusion
CVE-2013-0632
CWE-287
High
WordPress plugin Custom Contact Forms critical vulnerability
-
CWE-287
High
DotNetNuke multiple vulnerabilities
CVE-2012-1030
CWE-79
High
Ektron CMS Account Hijack
-
CWE-288
High
Oracle Sun GlassFish/Java System Application Server Remote Authentication Bypass Vulnerability
CVE-2011-0807
CWE-287
High
Method Tampering
-
CWE-285
High
HTTP verb tampering via POST
-
CWE-285
High
JAAS authentication bypass
-
CWE-288
High
JSP authentication bypass
-
CWE-287
High
Security vulnerability in MySQL/MariaDB sql/password.c
CVE-2012-2122
CWE-287
High
Misfortune Cookie vulnerability
CVE-2014-9222
CWE-119
High
Rails Devise authentication password reset
CVE-2013-0233
CWE-287
High
X-Forwarded-For HTTP header security bypass
-
CWE-287
High
Liferay JSON service API authentication vulnerability
-
CWE-287
High
MediaWiki multiple remote vulnerabilities
CVE-2012-4378
CWE-79
High
Joomla! Core Security Bypass
CVE-2017-11364
CWE-285
High
Spring Security Authentication Bypass
CVE-2016-5007
CWE-287
High
Ektron CMS authentication bypass
CVE-2018-12596
CWE-285
High
Oracle WebLogic Authentication Bypass
CVE-2018-2894
CWE-287
High
Oracle Business Intelligence AuthBypass CVE-2019-2768
CVE-2019-2768
CWE-200
High
Kentico CMS RCE CVE-2017-17736
CVE-2017-17736
CWE-425
High
AppWeb Authentication Bypass (CVE-2018-8715)
CVE-2018-8715
CWE-287
High
ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539)
CVE-2021-40539
CWE-287
High
Apache Shiro authentication bypass
CVE-2020-17523
CWE-287
High
Alibaba Nacos Authentication Bypass (CVE-2021-29441)
CVE-2021-29441
CWE-287
High
ntopng Authentication Bypass (CVE-2021-28073)
CVE-2021-28073
CWE-287
High
Unsafe use of Reflection
-
CWE-470
High
Fortinet Authentication bypass on administrative interface
CVE-2022-40684
CWE-288
High
SolarWinds Orion API Auth bypass (CVE-2020-10148)
CVE-2020-10148
CWE-287
High
Openfire Path Traversal (CVE-2023-32315)
CVE-2023-32315
CWE-22
High
Qlik Sense Enterprise Auth Bypass (CVE-2023-41266)
CVE-2023-41266
CWE-20
High
Sangfor NGAF Authentication Bypass
-
CWE-287
High
Strapi Cognito provider Authentication Bypass (CVE-2023-22893)
CVE-2023-22893
CWE-287
High
Ivanti EPMM API Authentication bypass (CVE-2023-35078/CVE-2023-35082)
CVE-2023-35082
CWE-287
High
Case-Insensitive Routing Bypass in Express.js Application
-
CWE-287
High
SAML Response without signature
-
CWE-347
High
No SAML Respose signature check
-
CWE-347
High
SAML Respose signature exclusion
-
CWE-347
High
WooCommerce Payments Authentication Bypass and Privilege Escalation
CVE-2023-28121
CWE-287
High
Grafana Snapshot Authentication Bypass (CVE-2021-39226)
CVE-2021-39226
CWE-287
High