PT-2026-65775

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stm lms delete cover function lacking ownership validation on the file id parameter befor...

PT-2025-62894

Name of the Vulnerable Software and Affected Versions better-auth passkey versions prior to 1.4.0 Description An insecure direct object reference occurs in the passkey deletion endpoint, allowing authenticated users to delete arbitrary passkeys. Attackers with valid sessions can send crafted...