PT-2026-115302

Name of the Vulnerable Software and Affected Versions CRMEB versions 5.6.1 through 6.0.0 Description An insecure direct object reference issue allows authenticated storefront users to access and claim orders belonging to other users. By enumerating sequential order IDs within the gift detail...

PT-2026-115308

Name of the Vulnerable Software and Affected Versions ClassroomIO version 1.0.0 Description An insecure direct object reference IDOR exists in the Hono API course submission routes. This allows course tutors or admins to modify submissions belonging to other courses by providing their own course ...

CVE-2026-111359: Authorization Bypass Through User-Controlled Key

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in giftdetail to harvest buyer identities and the giftkey, the...

CVE-2026-111363: Authorization Bypass Through User-Controlled Key

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary fileid values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/filebbox to...

CVE-2026-108092: Authorization Bypass Through User-Controlled Key

The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2sshipitem and b2sshipitemreloadurl AJAX handlers lacking per-object authorization on the postId parameter...

CVE-2026-110763

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...

CVE-2026-110764 AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since...

CVE-2026-103366

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-103366 Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

EUVD-2026-100901

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-110465

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student...

CVE-2026-110467

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student...

EUVD-2026-100873

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student...

CVE-2026-110467

The Tronclass application, developed by WisdomGarden , is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). Authenticated remote attackers can exploit this by modifying a specific parameter to unauthorizedly view the peer review scores of any student. No specific ...

CVE-2026-110467 WisdomGarden｜Tronclass - Insecure Direct Object Reference

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student...

CVE-2026-110465 WisdomGarden｜Tronclass - Insecure Direct Object Reference

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student...

CVE-2026-110465

The Tronclass platform developed by WisdomGarden contains an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). An authenticated remote attacker can exploit this by modifying a specific parameter to alter the peer review scores of any student. No specific exploit code or remediation...

EUVD-2026-100871

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student...

CVE-2026-110465 WisdomGarden｜Tronclass - Insecure Direct Object Reference

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student...

CVE-2026-110763: Authorization Bypass Through User-Controlled Key

lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employeeId values to read every employee's...