5657 matches found
CVE-2026-89063
The Bookly WordPress plugin (Online Scheduling and Appointment Booking System) is vulnerable to an Insecure Direct Object Reference (IDOR) via the conversation_id parameter in all versions up to and including 28.1 . Due to missing validation on this user-controlled key, unauthenticated attackers ...
PT-2026-93274
Name of the Vulnerable Software and Affected Versions Bookly versions prior to 28.2 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Unauthenticated attackers can enumerate customer conversations by incrementing the conversation id...
WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 9.0.0 - Insecure Direct Object Reference vulnerability
Insecure Direct Object Reference vulnerability discovered by Choriyev Qahramon in WordPress Plugin Blog2Social versions = 9.0.0...
CVE-2026-89063: Authorization Bypass Through User-Controlled Key
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversationid' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-68530 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances
Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...
CVE-2026-54050
Sakai (a Collaboration and Learning Environment) has an IDOR in its REST API: the DELETE /api/users/{userId}/profile/image endpoint in ProfileController.removeProfileImage() passes the attacker-controlled userId to the service layer without verifying ownership, allowing any authenticated user to ...
CVE-2026-89141: Authorization Bypass Through User-Controlled Key
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...
WordPress AI Engine plugin <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability
Insecure Direct Object Reference to Authenticated Subscriber+ Sensitive Attachment Disclosure via 'mediaId' Parameter vulnerability discovered by Chi Trung Huynh - Duy Tan Universiy in WordPress Plugin AI Engine versions = 3.7.7...
CVE-2026-36453
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables...
CVE-2026-36453
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables...
PT-2026-90959
Name of the Vulnerable Software and Affected Versions Rhymix versions prior to 2.1.31 Description An insecure direct object reference exists that allows the access of arbitrary files through the use of extra variables. Recommendations Update to version 2.1.31 or later...
EUVD-2026-77109
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables...
CVE-2026-54258
ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are n...
EUVD-2026-76203
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
CVE-2026-62134 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
EUVD-2026-76207
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
CVE-2026-62113 WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
CVE-2026-62113 WordPress Slim SEO plugin <= 4.10.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
CVE-2026-62140 WordPress Quiz And Survey Master plugin <= 11.2.5 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...