CVE-2026-54622 django CMS: Clipboard copy IDOR discloses unauthorized plugin content

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...

CVE-2026-64969

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969 Insecure Direct Object Reference in ATutor

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

EUVD-2026-63370

ATutor is vulnerable to Insecure Direct Object Reference IDOR attack in profile picture related endpoints. Any authenticated user, including a student, can supply another user's memberid in a POST request to the profile album endpoint and permanently delete that user's profile picture, including...

CVE-2026-64969

ATutor (last confirmed vulnerable at v2.2.4) has an IDOR flaw in its profile album endpoint: any authenticated user can POST another user's member_id and permanently delete that user's profile picture, including instructors and administrators. The product is no longer supported and unpatched. CVS...

CVE-2026-76634

WeGIA before 3.9.2 is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the employee profile page (profile_funcionario.php). The root cause is a request extraction function that allows an attacker-supplied id_pessoa parameter to overwrite the session-derived identifier, enab...

CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

EUVD-2026-63359

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

PT-2026-79196

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.1.3 Description An authenticated user with file-edit permissions can disclose the existence and titles of reservations across private trip boundaries. The application fails to use the findForeignLinkTarget function to...

PT-2026-79188

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...

CVE-2026-53548 Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or...

CVE-2026-53548 Termix: IDOR — Authenticated user can fetch SSH passwords for hosts owned by other users

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or...

CVE-2026-53548

Any authenticated Termix user with a valid JWT can enumerate sequential host IDs via the GET /host/db/host/:id/password endpoint to retrieve plaintext SSH/sudo passwords of other users due to missing host ownership enforcement. CVSS 9.6 Critical. Fixed in version 2.6.1; no in-the-wild exploitatio...

Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Impact Any activated account in a company can read every maintenance record for that company asset tag, supplier, purchase cost, free-text notes, dates without holding any asset or maintenance permission. Summary MaintenancesController::show renders a maintenance record without any authorization...

GHSA-R9R3-G9FP-3Q4Q Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GET

Impact Any activated account in a company can read every maintenance record for that company asset tag, supplier, purchase cost, free-text notes, dates without holding any asset or maintenance permission. Summary MaintenancesController::show renders a maintenance record without any authorization...

Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Impact An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application. Steps to Reproduce: 1. Log in as a restricted user. 2. Send a GET request to /api/v1/users/targetid/eula...

GHSA-3HGV-JR5J-CG9X Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Impact An attacker can completely bypass file-name randomization security and without authorization download confidential, signed EULA files belonging to any other user across the application. Steps to Reproduce: 1. Log in as a restricted user. 2. Send a GET request to /api/v1/users/targetid/eula...

CVE-2026-55519

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with generic asset edit permission can delete files attached to assets outside the user's ownership or company assignment. The destroy methods in app/Http/Controllers/Api/UploadedFilesController.php and...

CVE-2026-55694 Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File Takeover

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/targetid/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/filename. The primary /stored-eula-file/filename rout...

EUVD-2026-62631

Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/targetid/eulas to obtain another user's randomized EULA filename and then download the signed file through /account/stored-eula-file/filename. The primary /stored-eula-file/filename rout...