CVE-2026-90534 Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method

Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounted without any route-level permission check and invokes component loadMethods with an attacker-controlled nodeName, loadMethod, inputs, and...

CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87894

CVE-2026-87894 affects the Rox Appointment Booking WordPress plugin in versions 1.0.9 through 1.2.2 . The vulnerability is an Insecure Direct Object Reference (IDOR) : the endpoint that returns a booking's confirmation details performs no authorization check , and each booking is addressed by a s...

CVE-2026-84025 BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

CVE-2026-82851 Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft...

CVE-2026-84025

BEAR – Bulk Editor and Products Manager Professional for WooCommerce (WordPress plugin) versions before 1.2.2 are affected by an IDOR (Insecure Direct Object Reference) vulnerability. Several handlers that return product data by a user-supplied identifier fail to perform ownership checks, allowin...

CVE-2026-82851

The Masteriyo LMS WordPress plugin (versions 1.14.0 through 3.4.0 ) contains an Insecure Direct Object Reference (IDOR) flaw in its download endpoint. The plugin fails to verify ownership of, or restrict the type of, records a user requests for download. As a result, any user with the instructor ...

CVE-2025-65672

CVE-2025-65672 Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows unauthorized share and invite access to course settings. Affected Product: ClassroomIO Affected Version: 0.1.13 Discovered by: Rivek Raj Tamang RivuDon, Sikkim, India Vulnerability Details Insecure Direct Object...

CVE-2022-22828

CVE-2022-22828 Synametrics - SynaMan versión 4.9 Resumen Viden Labs ha encontrado una vulnerabilidad de Referencia Directa a Objetos Insegura IDOR en SynaMan de Synametrics. Esta vulnerabilidad está presente en las versiones 4.9 y anteriores. Esta vulnerabilidad ha sido parcheada en la versión 5....

PT-2026-90576

The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing users who are restricted to their own products to read other owners' product information, including protected downloadable file URLs and...

cve-2026-29204-whmcs-clientarea-addonid

CVE-2026-29204 — WHMCS client area addon guard Unofficial community notes for CVE-2026-29204: on clientarea.php?action=productdetails, a logged-in client can supply a foreign addonId with modop=custom and reach module context that does not belong to the session. Upgrade first. Apply a...

CVE-2026-49464 NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL...

CVE-2026-49464

The nl.nl-portal:taak package in NL Portal Backend Libraries (Dutch government portals) has an insecure direct object reference (IDOR) in the submitTaakV2 GraphQL mutation. Versions 1.5.0 through 3.0.0 fail to verify task ownership: the resolver fetches a task by UUID and transitions it to comple...

jsherp-user-info-idor

jshERP /user/info IDOR — VulDB submission package This repository contains a standalone VulDB-style advisory for an authenticated insecure direct object reference in jshERP. Product: jshERP Tested commit: ad6cf886dd4e0676723060a25d361c703dc56bc0 3.6-SNAPSHOT, GitHub master HEAD on 2026-09-04...

CVE-2026-62140

Unauthenticated Insecure Direct Object References IDOR in Quiz And Survey Master = 11.2.5 versions...

CVE-2026-62134

Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...

CVE-2026-62113

Contributor Insecure Direct Object References IDOR in Slim SEO = 4.10.0 versions...

EUVD-2026-76203

Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...

CVE-2026-62134 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Starter Templates = 4.7.5 versions...

CVE-2026-62134

An Insecure Direct Object References (IDOR) vulnerability was identified in the WordPress Starter Templates plugin (versions ≤ 4.7.5 ). The flaw allows a contributor-level authenticated user to manipulate objects they should not have access to, resulting in a low integrity impact (CVSS 4.3, MEDIU...