5483 matches found
CVE-2026-84836
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84769
Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...
CVE-2026-84836 WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84769
CVE-2026-84769 affects the WordPress Business Directory plugin in versions
WordPress WC Ukraine Shipping plugin <= 1.22.5 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin WC Ukraine Shipping versions = 1.22.5...
PT-2026-85120
Subscriber Insecure Direct Object References IDOR in WC Ukraine Shipping = 1.22.3 versions...
CVE-2026-84771
Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...
CVE-2026-84771 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...
CVE-2026-84771 WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in PublishPress Permissions = 4.8.3 versions...
WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin PublishPress Permissions versions = 4.8.3...
CVE-2026-84148 Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System
This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating parameter which could lead to exposure of sensitive information belonging to other users o...
CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...
EUVD-2026-68407
ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operations. A workspace admin can create, view, and delete database tables in another workspace by replacing the organizationId parameter in...
CVE-2026-81299
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
CVE-2026-81299 WordPress WP Job Portal plugin <= 2.5.9 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
CVE-2026-81299
CVE-2026-81299 affects the WordPress WP Job Portal plugin, versions
EUVD-2026-67729
Subscriber Insecure Direct Object References IDOR in WP Job Portal = 2.5.9 versions...
CVE-2026-81817 Flowintel Missing Task-to-Case Authorization Allows Cross-Case Task Modification
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...
CVE-2026-81817
Flowintel versions ≥3.3.0 are affected by an insecure direct object reference (broken object-level authorization) across numerous task endpoints. The routes accepted both a case ID and a task ID but did not verify that the task belonged to the supplied case, allowing an authenticated user with ed...