5489 matches found
EUVD-2026-50136
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...
CVE-2026-63241
Koollab LMS is affected by an insecure direct object reference vulnerability that allows an authenticated user to query the course completion progress of other users without proper authorization, leading to disclosure of private learning progress information. The root cause is an insecure direct ...
CVE-2026-63241 Insecure direct object reference vulnerability
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...
CVE-2026-63241: Authorization Bypass Through User-Controlled Key
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...
PT-2026-65839
An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...
CVE-2025-60931
An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...
CVE-2025-60931
An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...
PT-2026-65712
An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...
CVE-2025-60931
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 . An unauthorized attacker can arbitrarily view the compensation information of other employees by sending a crafted GET request . Exploitation details are...
CVE-2026-14926
The FluentCart A New Era of eCommerce WordPress plugin, in versions before 1.4.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that a subscription belongs to the requesting customer across several payment-method endpoints . This oversight allows an...
EUVD-2026-49693
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
CVE-2026-16797
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
PT-2026-65400
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
CVE-2026-16797: Authorization Bypass Through User-Controlled Key
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
