Lucene search
+L

2887 matches found

NVD
NVD
added 2026/08/20 10:17 p.m.20 views

CVE-2026-55489

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

4.9CVSS0.00193EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/20 9:51 p.m.13 views

EUVD-2026-63642

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

4.3CVSS5.4AI score0.00256EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/20 9:51 p.m.31 views

CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

4.3CVSS0.00256EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/20 9:51 p.m.26 views

CVE-2026-62945

TREK (a collaborative travel planner) prior to 3.1.3 contains an authorization bypass in its file upload, update, and link endpoints. The affected actions accept attacker-controlled reservation_id, place_id, and assignment_id values without invoking findForeignLinkTarget() to verify that the refe...

4.3CVSS5.3AI score0.00256EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/20 9:51 p.m.17 views

CVE-2026-62945 TREK: Cross-trip reservation title disclosure via file links

TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservationid, placeid, and assignmentid values without using findForeignLinkTarget to verify that the referenced object belongs to the file's trip. An authenticated user...

4.3CVSS5.6AI score
SaveExploits0References6
EUVD
EUVD
added 2026/08/20 9:49 p.m.17 views

EUVD-2026-63639

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

6.5CVSS5.4AI score0.00304EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/20 9:49 p.m.14 views

CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

6.5CVSS5.5AI score
SaveExploits0References6
CVE
CVE
added 2026/08/20 9:49 p.m.28 views

CVE-2026-54509

TREK (collaborative travel planner) versions 3.0.0 through 3.1.0 contain an IDOR vulnerability in the GET /api/journeys/:id/share-link route. The endpoint returns a journey share token without verifying that the authenticated requester owns or has access to the target journey. Because journey IDs...

6.5CVSS5.3AI score0.00304EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/20 9:49 p.m.34 views

CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

6.5CVSS0.00304EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/20 9:36 p.m.36 views

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

4.9CVSS0.00193EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/20 9:36 p.m.30 views

CVE-2026-55489

BigBlueButton (open-source virtual classroom) is vulnerable to an IDOR (Insecure Direct Object Reference) in its presentation deletion handler. Prior to 3.0.29 , the file RemovePresentationPubMsgHdlr.scala did not verify that a submitted presentationId belonged to the same meeting before performi...

4.9CVSS5.2AI score0.00193EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 9:36 p.m.22 views

CVE-2026-55489 BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass

BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting...

4.9CVSS5.5AI score
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/08/20 6:44 p.m.18 views

Winter: My Account preview exposes another backend user's profile by record ID

Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...

5.6AI score
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/08/20 6:42 p.m.11 views

GHSA-42VX-43VC-X6PR Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Summary Backpack CRUD contained an authorization issue in the way...

6.5CVSS5.6AI score0.00247EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/20 6:42 p.m.18 views

Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation

Vulnerability Details Affected area: HasMany / MorphMany relation handling during CRUD create and update operations CWE: CWE-862 — Missing Authorization Severity: Medium CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Summary Backpack CRUD contained an authorization issue in the way...

6.5CVSS5.6AI score0.00247EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/20 6:42 p.m.12 views

django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

6.5CVSS5.4AI score0.00239EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/08/20 6:42 p.m.11 views

GHSA-4XFR-4P46-GC6P django CMS: Clipboard copy IDOR discloses unauthorized plugin content

Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target the user's own clipboard and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the secret content. Details In...

6.5CVSS5.5AI score0.00239EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/20 6:39 p.m.12 views

GHSA-3277-H8G9-QJ5F Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

5.4CVSS5.7AI score0.00143EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/08/20 6:39 p.m.15 views

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup FileUpload::getFileRecord resolved the posted id against the global systemfiles table without verifying that the file belonged to the widget's ow...

5.4CVSS5.6AI score0.00143EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/08/20 6:38 p.m.11 views

GHSA-VGMV-8XJC-6RCH Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

Summary Backpack CRUD's list and read operations correctly apply any query scopes registered via addClause / addBaseClause e.g. tenant isolation, user ownership. However, the Update, Delete, and Reorder operations bypassed these scopes, fetching records directly from the unscoped model query. An...

7.6CVSS5.6AI score0.00329EPSS
SaveExploits0References4
Rows per page
Query Builder