2849 matches found
CVE-2025-48207
The reintdownloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48205
The srfeuserregister extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48202
The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48202
The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48207
The reintdownloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48205
The srfeuserregister extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48202
The CVE-2025-48202 entry applies to the TYPO3 femanager extension (versions up to 8.2.1). The vulnerability is an Insecure Direct Object Reference (IDOR) in the newAction of the newController, allowing attackers to view frontend user data via a user parameter. Root cause is unsafe direct object r...
CVE-2025-48205
The CVE-2025-48205 entry concerns the sr_feuser_register extension for TYPO3 (up to version 12.4.8). The root cause is an Insecure Direct Object Reference that allows attackers to read arbitrary files. Impact is a high-severity exposure of potentially sensitive information. Public references in c...
CVE-2025-48205
The srfeuserregister extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48207
The reintdownloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference...
CVE-2025-48207
The CVE-2025-48207 entry concerns the TYPO3 reint_downloadmanager extension (versions up to 5.0.0). Affected component: reint_downloadmanager’s downloadAction handling allows Insecure Direct Object Reference via the downloaduid parameter, enabling attackers to read arbitrary files. Impact: inform...
Authorization Bypass Through User-Controlled Key
Overview in2code/femanager is a Modern TYPO3 Frontend User Registration. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the newAction function in NewController.php. An attacker can use an insecure direct object reference and view user data ...
PT-2025-22371
Name of the Vulnerable Software and Affected Versions femanager extension versions prior to 8.2.2 Description The issue allows attackers to view frontend user data. This is achieved through an Insecure Direct Object Reference IDOR in the femanager TYPO3 extension, where attackers can exploit a us...
PT-2025-22391
Name of the Vulnerable Software and Affected Versions reint downloadmanager extension versions prior to 5.0.1 Description The issue allows Insecure Direct Object Reference, enabling remote attackers to read arbitrary files via the downloaduid parameter in the "downloadAction". Recommendations For...
WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability
Insecure Direct Object References IDOR Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Job Portal versions = 2.3.2...
CVE-2025-48272
CVE-2025-48272 is a Missing Authorization / Insecure Direct Object References (IDOR) vulnerability in the WordPress plugin WP Job Portal (versions up to 2.3.2). Exploitation involves bypassing access controls to access restricted objects. The CVE entry aligns with Patchstack’s note that WP Job Po...
CVE-2025-48272 WordPress WP Job Portal <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability
Missing Authorization vulnerability in wpjobportal WP Job Portal allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Job Portal: from n/a through 2.3.2...
CVE-2025-48272 WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability
Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through = 2.3.2...
WordPress BuddyBoss platform plugin < 2.7.60 - Private Comment Exposure via IDOR vulnerability
Private Comment Exposure via IDOR vulnerability discovered by Faris Krivi in WordPress Plugin Buddyboss Platform versions 2.7.60...
