CVE-2026-72543 OpenSignLabs OpenSign - Insecure Direct Object Reference

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks...

CVE-2026-19424

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

CVE-2026-19424 Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

CVE-2026-19424

CVE-2026-19424 affects Inventec Appliances’ Chiline Cloud. It describes an Insecure Direct Object Reference allowing unauthenticated remote attackers to modify a parameter to read other users’ sensitive data. The CVSS metrics indicate a high risk: CVSS‑3.1 base score 7.5 (NETWORK, LOW attack comp...

CVE-2026-19424 Inventec Appliances｜Chiline Cloud - Insecure Direct Object Reference

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

CVE-2026-19424

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

CVE-2026-72546: Authorization Bypass Through User-Controlled Key

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

PT-2026-70122

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownershi...

PT-2026-70121

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the...

CVE-2026-72545: Authorization Bypass Through User-Controlled Key

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target...

PT-2026-70120

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target...

CVE-2026-19424: Authorization Bypass Through User-Controlled Key

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

CVE-2026-15238 Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account Subscriber and above to modify or overwrite the personal data of any customer by supplying an arbitrary...

EUVD-2026-54171

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-70561: Authorization Bypass Through User-Controlled Key

TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts, to read arbitrary attachments by supplying an integer attachment ID to the attachmentdownload.php handler without any project or role...

CVE-2026-19111

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

CVE-2026-15147

The vulnerability CVE-2026-15147 affects the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The issue is an unauthenticated payment-notification bypass caused by failing to verify the payment recipient, amount, and status, and not binding the notification to the inten...

CVE-2026-28180 WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...

CVE-2026-14314

The PeproDev WooCommerce Receipt Uploader WordPress plugin (versions

PT-2026-68680

Name of the Vulnerable Software and Affected Versions Amazon Strands Agents Tools versions prior to 0.8.3 Description An insecure direct object reference exists in the mongodb memory, elasticsearch memory, and mem0 memory tools. Remote authenticated users can access, modify, or delete memories...