SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Unsichere direkte Objektreferenz IDOR-Schwachstelle in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Produkt: SOGo Betroffene Versionen: v5.6.0 Auswirkung: Unsichere direkte Objektreferenz IDOR-Schwachstelle → Ermöglicht dem Benutzer, E-Mails im Namen eines anderen...

CVE-2024-23747

CVE-2024-23747 Il sistema di gestione ospedaliera ModernaNet 2024 di Moderna Sistemas è suscettibile a una vulnerabilità di Insecure Direct Object Reference IDOR. PoC Questa vulnerabilità risiede nella gestione dell'accesso ai dati utente da parte del sistema tramite un URL...

CVE-2025-47226

CVE-2025-47226 - Vulnerabilità IDOR in Snipe-IT = v8.0.4 🚨 La vulnerabilità Insecure Direct Object Reference IDOR in Snipe-IT consente agli utenti autenticati di visualizzare informazioni sugli asset di altri dipartimenti alterando locationid. ✍️ Scoperto Da Siripong Jintung GitHub: Sn1p3r-H4ck3r...

CVE-2026-77143

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...

CVE-2026-77135

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...

EUVD-2026-65341

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...

EUVD-2026-65334

The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the...

EUVD-2026-65333

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...

CVE-2026-78466

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

CVE-2026-78466

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0.11 , caused by missing validation on a user-controlled key. Authenticated attackers with Subscriber-level access or above can perform an unauthorized action. The CV...

EUVD-2026-65298

The Fluent Boards Pro plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.11 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an...

CVE-2018-7691

CVE-2018-7691 Die SSC REST API enthält Schwachstellen bezüglich Insecure Direct Object Reference IDOR, die authentifizierten Benutzern Zugriff auf beliebige Details der lokalen und LDAP-Benutzer über die POST-Methode und auf beliebige Details der Fortify-Projekte anderer Benutzer über die...

CVE-2025-51869

CVE-2025-51869 Descrizione della vulnerabilità Liner è un motore di ricerca AI affidabile con oltre 10 milioni di utenti in tutto il mondo. Liner costruisce un motore di ricerca basato su LLM, che è vulnerabile a un Insecure Direct Object Reference IDOR nel suo componente chat. Un attaccante può...

CVE-2022-31295

CVE-2022-31295 Online Diskussionsforum Site 1.0 - IDOR / Beliebiges Posting löschen Exploit-Titel: Online Diskussionsforum Site 1.0 - IDOR / Beliebiges Posting löschen Datum: 2022-06-13 CVE: CVE-2022-31295 Exploit-Autor: Abdulaziz Saad @b4zb0z Hersteller-Homepage: https://www.sourcecodester.com/...

CVE-2026-10630

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

CVE-2026-10630 WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

CVE-2026-10630

WP Courses LMS (WordPress plugin) is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.2.29 . The resultID parameter in the wpcq_get_quiz_result AJAX action lacks proper ownership validation, allowing authenticated users with custom-level access or above ...

WordPress WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Authenticated Custom+ Sensitive Information Disclosure vulnerability discovered by Vapour in WordPress Plugin WP Courses LMS versions = 3.2.29...

EUVD-2026-65192

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key...

CVE-2018-7690

CVE-2018-7690 L'API REST di SSC contiene vulnerabilità di Insecure Direct Object Reference IDOR che consentono agli utenti autenticati di accedere a dettagli arbitrari degli utenti Local e LDAP tramite il metodo POST e a dettagli arbitrari dei progetti Fortify di altri utenti tramite il metodo GE...