2495 matches found
CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...
CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...
CVE-2026-69189
Hoppscotch versions prior to 2026.6.0 contain an IDOR vulnerability in team and UserHistory GraphQL resolvers: authenticated workspace members can read other users' private request history, authorization headers, session data, and environment values, and modify or delete victim history entries. F...
CVE-2026-69189
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...
CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...
CVE-2026-74009
The WordPress Razorpay for WooCommerce plugin (versions ≤ 4.8.7) has an unauthenticated IDOR vulnerability allowing unauthorized access to arbitrary object references. CVSS 5.3 (MEDIUM) reflects low integrity impact. Exploitation details are not provided. Upgrade to a patched version beyond 4.8.7...
CVE-2026-74009 WordPress Razorpay for WooCommerce plugin <= 4.8.7 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...
EUVD-2026-60817
Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...
CVE-2026-73395 WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
EUVD-2026-60801
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73395
The WordPress plugin Booking calendar, Appointment Booking System (versions ≤ 3.2.36) has an unauthenticated IDOR flaw, discovered by Jakub Herman, allowing remote attackers to access or modify objects without authentication. CVSS 3.1 scores 6.5 (Medium) with no in-the-wild exploitation reported....
CVE-2026-73189
The WordPress WP Crowdfunding plugin (versions below 2.2.1) has an IDOR vulnerability allowing authenticated subscribers to access other users' data via direct object references. Patchstack reports a CVSS 6.5 (MEDIUM) with HIGH confidentiality impact. Exploitation in the wild is not documented; u...
EUVD-2026-60939
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
CVE-2026-73189
Subscriber Insecure Direct Object References IDOR in WP Crowdfunding 2.2.1 versions...
CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66634
The Modal Survey WordPress plugin (versions ≤ 2.0.2.2.3) contains an IDOR flaw allowing authenticated subscribers to access or modify objects without authorization. Patchstack reports it; no patch version or exploitation evidence is provided in the documents. Upgrade to a newer version if availab...
EUVD-2026-60919
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66634 WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...