5657 matches found
CVE-2026-11496 Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...
PT-2026-90032
Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...
PT-2026-89746
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on wp aja...
PT-2026-90028
Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...
CVE-2024-12145: Missing Authorization
The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bpnotificationsactionbulkmanage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level...
CVE-2026-11496: Missing Authorization
The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...
WordPress BuddyPress plugin <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion vulnerability
Insecure Direct Object Reference to Notifications Deletion vulnerability discovered by Brian Mungai in WordPress Plugin BuddyPress versions = 14.3.3...
CVE-2026-80434 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...
CVE-2026-80434
IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an insecure direct object reference (IDOR) flaw that allows a remote authenticated attacker to manipulate runtime caches and cause a denial of service . The vulnerability carries a CVSS 3.1 score of 7.4 (HIGH) , with a scope change indica...
WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Starter Templates versions = 4.7.5...
PT-2026-89623
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can cause a denial of service by manipulating runtime caches. This is possible due to an insecure direct object reference, which occurs when an...
CVE-2026-80434: Authorization Bypass Through User-Controlled Key
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...
CVE-2026-81802
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
CVE-2026-81802 WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
EUVD-2026-72645
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
PT-2026-86991
Unauthenticated Insecure Direct Object References IDOR in WpEvently = 5.6.0 versions...
CVE-2026-86489
JetBrains YouTrack before version 2026.2.18634 contains an IDOR (Insecure Direct Object Reference) vulnerability in the user profile API , allowing an attacker with low-level privileges to disclose private issues and starred folders across organizations via the network. The CVSS 3.1 score is 6.5 ...
WordPress WpEvently plugin <= 5.6.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by benzdeus in WordPress Plugin WpEvently versions = 5.6.0...
CVE-2026-86451
MISP versions ≤2.5.45 contain an insecure direct object reference (IDOR) in EventGraphTool::get_reference_data(). Authenticated users could retrieve object-reference records by UUID without the system verifying that the requester had access to the parent object , allowing retrieval of reference d...