123 matches found
CVE-2026-2697
An Indirect Object Reference IDOR in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter...
CVE-2026-2697
An Indirect Object Reference IDOR in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter...
CVE-2026-2697 Indirect Object Reference (IDOR) in Security Center
An Indirect Object Reference IDOR in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter...
CVE-2026-2697
CVE-2026-2697 is an IDOR vulnerability in Tenable Security Center prior to 6.8.0 where an authenticated remote attacker can escalate privileges via the owner parameter. Multiple sources (NVD, Red Hat, CVE listings, and Tenable advisory) confirm the issue and its association with Security Center. ...
CVE-2026-2697 Indirect Object Reference (IDOR) in Security Center
An Indirect Object Reference IDOR in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter...
PT-2026-21523
Name of the Vulnerable Software and Affected Versions Security Center affected versions not specified Description An Indirect Object Reference IDOR exists in Security Center that could allow an authenticated remote attacker to escalate privileges. The issue is related to the owner parameter. An...
CVE-2025-68051 WordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through = 2.0.8...
Tenable Security Center < 6.8.0 Multiple Vulnerabilities (TNS-2026-07)
According to its self-reported version, the Tenable Security Center running on the remote host is prior to 6.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-07 advisory. - A flaw was found in the libssh implements abstract layer for message digest MD...
WordPress Booking Calendar plugin <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modification vulnerability
Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Settings Modification vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Booking Calendar versions = 10.14.14...
[R2] Security Center Version 6.8.0 Fixes Multiple Vulnerabilities
R2 Security Center Version 6.8.0 Fixes Multiple Vulnerabilities Arnie Cabral Wed, 02/18/2026 - 08:32 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components libssh, postgresql were found to contain vulnerabilities, and updated...
CVE-2026-1436 Improper Access Control (IDOR) vulnerability in Graylog Web Interface
Improper Access Control IDOR in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other user's profiles without proper authorization checks. Exploiting this vulnerability allows valid users of the system to be listed and sensitive...
CVE-2025-10912
CVE-2025-10912 describes an authorization bypass in TemizlikYolda (Saastech Cleaning and Internet Services Inc.) where an attacker can manipulate user-controlled variables to bypass access controls. The CVSS v3.1 base metrics indicate: AV:N, AC:L, PR:L, UI:N, S:U, C:N, I:L, A:L, with a base score...
WordPress SP Project & Document Manager plugin <= 4.71 - Subscriber+ File Download via IDOR vulnerability
Subscriber+ File Download via IDOR vulnerability discovered by fewwords in WordPress Plugin SP Project & Document Manager versions = 4.71...
CVE-2026-22426 WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Elated-Themes Sweet Jane sweetjane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sweet Jane: from n/a through = 1.2...
CVE-2026-22396
CVE-2026-22396 affects the WordPress Fiorello theme from Mikado-Themes up to version 1.0 (Fiorello). The vulnerability is described as an Authorization Bypass Through a User-Controlled Key, effectively an Insecure Direct Object References (IDOR) flaw that allows bypassing access control to sensit...
CVE-2025-10855 IDOR in Solvera Software's Teknoera
Authorization Bypass Through User-Controlled Key vulnerability in Solvera Software Services Trade Inc. Teknoera allows Exploitation of Trusted Identifiers. This issue affects Teknoera: through 01102025...
CVE-2026-23843 teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers
teklifolusturapp is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401b6224eead4fb183ea1c, an Insecure Direct Object Reference IDOR vulnerability exists in the offer view functionality. Authenticated users can...
CVE-2025-4596 Information disclosure via IDOR in Asseco AMDX
Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in 6.09.01.62 version of ADMX...
CVE-2025-68071 WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through = 5.3.2...