CVE-2025-48205

The srfeuserregister extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference...

CVE-2025-48205

The CVE-2025-48205 entry concerns the sr_feuser_register extension for TYPO3 (up to version 12.4.8). The root cause is an Insecure Direct Object Reference that allows attackers to read arbitrary files. Impact is a high-severity exposure of potentially sensitive information. Public references in c...

CVE-2025-48205

The srfeuserregister extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference...

CVE-2025-48207

The reintdownloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference...

CVE-2025-48207

The CVE-2025-48207 entry concerns the TYPO3 reint_downloadmanager extension (versions up to 5.0.0). Affected component: reint_downloadmanager’s downloadAction handling allows Insecure Direct Object Reference via the downloaduid parameter, enabling attackers to read arbitrary files. Impact: inform...

Authorization Bypass Through User-Controlled Key

Overview in2code/femanager is a Modern TYPO3 Frontend User Registration. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the newAction function in NewController.php. An attacker can use an insecure direct object reference and view user data ...

PT-2025-22371

Name of the Vulnerable Software and Affected Versions femanager extension versions prior to 8.2.2 Description The issue allows attackers to view frontend user data. This is achieved through an Insecure Direct Object Reference IDOR in the femanager TYPO3 extension, where attackers can exploit a us...

PT-2025-22391

Name of the Vulnerable Software and Affected Versions reint downloadmanager extension versions prior to 5.0.1 Description The issue allows Insecure Direct Object Reference, enabling remote attackers to read arbitrary files via the downloaduid parameter in the "downloadAction". Recommendations For...

WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability

Insecure Direct Object References IDOR Vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Job Portal versions = 2.3.2...

CVE-2025-48272

CVE-2025-48272 is a Missing Authorization / Insecure Direct Object References (IDOR) vulnerability in the WordPress plugin WP Job Portal (versions up to 2.3.2). Exploitation involves bypassing access controls to access restricted objects. The CVE entry aligns with Patchstack’s note that WP Job Po...

CVE-2025-48272 WordPress WP Job Portal <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability

Missing Authorization vulnerability in wpjobportal WP Job Portal allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Job Portal: from n/a through 2.3.2...

CVE-2025-48272 WordPress WP Job Portal plugin <= 2.3.2 - Insecure Direct Object References (IDOR) Vulnerability

Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through = 2.3.2...

WordPress BuddyBoss platform plugin < 2.7.60 - Private Comment Exposure via IDOR vulnerability

Private Comment Exposure via IDOR vulnerability discovered by Faris Krivi in WordPress Plugin Buddyboss Platform versions 2.7.60...

TYPO3-EXT-SA-2025-004: Insecure Direct Object Reference in extension "Download manager" (reint_downloadmanager)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-004...

TYPO3-EXT-SA-2025-006: Insecure Direct Object Reference in extension "femanager" (femanager)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-006...

CVE-2025-39537 WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: from n/a through = 1.2.3...

WordPress WP JobHunt plugin <= 7.1 - Insecure Direct Object References (IDOR) Vulnerability

Insecure Direct Object References IDOR Vulnerability discovered by Bonds in WordPress Plugin WP JobHunt versions = 7.1...

CVE-2025-3769

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.92 via the 'viewbookingsummaryinlightbox' due to missing validation on a user controlled key. This makes it possible...

CVE-2024-8988

The PeepSo Core: File Uploads plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.6.0 via the filedownload REST API endpoint due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to...

CVE-2025-4762

CVE-2025-4762 affects eSigna versions 1.0–1.5, via an IDOR in the eSignaViewer component that lets an unauthenticated attacker access arbitrary files in the document system by manipulating file paths and object identifiers. The PT-2025-21276 entry confirms the vulnerable component and remediation...