Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

2918 matches found

Positive Technologies
Positive Technologies•added 2025/03/20 12:00 a.m.•10 views

PT-2025-12098 · Unknown · Lunary-Ai/Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.6.0 Description: An Insecure Direct Object Reference IDOR vulnerability exists in the "PATCH /v1/runs/:id/score" endpoint. This issue allows an attacker to update the score data of any run by manipulating the id...

7.5CVSS7.2AI score0.00548EPSS
SaveExploits1References6
RedhatCVE
RedhatCVE•added 2025/03/15 7:06 a.m.•9 views

CVE-2025-2271

A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference IDOR vulnerability in the Issuetrak audit component. The vulnerability enables unauthorized access to sensitive...

7.7CVSS6.7AI score0.00319EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE•added 2025/03/15 4:05 a.m.•9 views

CVE-2024-13887

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajaxlistingsubmitimageupload' function due to missing validation on a user controlled key. This makes...

5.3CVSS6.8AI score0.00262EPSS
SaveExploits0References1
Cvelist
Cvelist•added 2025/03/13 6:30 a.m.•22 views

CVE-2025-2271 IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.asp

A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference IDOR vulnerability in the Issuetrak audit component. The vulnerability enables unauthorized access to sensitive...

7.7CVSS0.00319EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment•added 2025/03/13 6:30 a.m.•4 views

CVE-2025-2271 IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.asp

A vulnerability exists in Issuetrak v17.2.2 and prior that allows a low-privileged user to access audit results of other users by exploiting an Insecure Direct Object Reference IDOR vulnerability in the Issuetrak audit component. The vulnerability enables unauthorized access to sensitive...

7.7CVSS7.5AI score0.00319EPSS
SaveExploits0References1
CVE
CVE•added 2025/03/13 3:21 a.m.•55 views

CVE-2024-13887

CVE-2024-13887 concerns the WordPress plugin Business Directory Plugin – Easy Listing Directories for WordPress (versions

5.3CVSS5.2AI score0.00262EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2025/03/13 3:21 a.m.•18 views

CVE-2024-13887 Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Arbitrary Image Addition

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajaxlistingsubmitimageupload' function due to missing validation on a user controlled key. This makes...

5.3CVSS0.00262EPSS
SaveExploits0References2
Veracode
Veracode•added 2025/03/10 8:21 a.m.•13 views

Insecure Direct Object Reference (IDOR)

github.com/zitadel/zitadel is vulnerable to Insecure Direct Object Reference IDOR. The vulnerability is due to insufficient access control in the Admin API, allowing authenticated users without specific IAM roles to modify sensitive settings...

9CVSS6.7AI score0.00587EPSS
SaveExploits0References17Affected Software1
RedhatCVE
RedhatCVE•added 2025/03/10 6:51 a.m.•16 views

CVE-2024-12114

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogalleryattachmentmodalsave AJAX action due to missing validation on a user controll...

4.3CVSS6.8AI score0.00309EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE•added 2025/03/09 9:28 a.m.•10 views

CVE-2024-13552

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to...

4.3CVSS6.6AI score0.00316EPSS
SaveExploits0References1
NVD
NVD•added 2025/03/08 6:15 a.m.•41 views

CVE-2024-12114

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogalleryattachmentmodalsave AJAX action due to missing validation on a user controll...

4.3CVSS0.00309EPSS
SaveExploits0References3
OSV
OSV•added 2025/03/08 6:15 a.m.•9 views

CVE-2024-12114

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogalleryattachmentmodalsave AJAX action due to missing validation on a user controll...

4.3CVSS6.5AI score0.00309EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2025/03/08 5:30 a.m.•9 views

CVE-2024-12114 FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogalleryattachmentmodalsave AJAX action due to missing validation on a user controll...

4.3CVSS6.9AI score0.00309EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2025/03/08 5:30 a.m.•35 views

CVE-2024-12114 FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates

The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.29 via the foogalleryattachmentmodalsave AJAX action due to missing validation on a user controll...

4.3CVSS0.00309EPSS
SaveExploits0References3
CVE
CVE•added 2025/03/08 5:30 a.m.•70 views

CVE-2024-12114

CVE-2024-12114 affects FooGallery for WordPress (

4.3CVSS4.5AI score0.00309EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist•added 2025/03/07 9:21 a.m.•17 views

CVE-2024-13552 SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to...

4.3CVSS0.00316EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2025/03/07 9:21 a.m.•5 views

CVE-2024-13552 SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference

The SupportCandy – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.0 via file upload due to missing validation on a user controlled key. This makes it possible for authenticated attackers to...

4.3CVSS6.9AI score0.00316EPSS
SaveExploits0References3
Packet Storm
Packet Storm•added 2025/03/06 12:00 a.m.•257 views

UniRide Vehicle Booking Management System 1.0 Insecure Direct Object Reference

UniRide Vehicle Booking Management System version 1.0 suffers from an insecure direct object reference vulnerability. ============================================================================================================================================= | Title : UniRide Vehicle Booking...

7.4AI score
SaveExploits0
RedhatCVE
RedhatCVE•added 2025/03/05 1:07 a.m.•21 views

CVE-2025-25952

An Insecure Direct Object References IDOR in the component /getStudemtAllDetailsById?studentId=XX of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows attackers to access sensitive user information via a crafted API request...

6.5CVSS6.3AI score0.00351EPSS
SaveExploits0References1
Packet Storm
Packet Storm•added 2025/03/05 12:00 a.m.•216 views

Employee Leaves Management System 2.1 Insecure Direct Object Reference

Employee Leaves Management System version 2.1 suffers from an insecure direct object reference vulnerability. Exploit Title: Employee Leaves Management System ELMS v2.1 - Authenticated Insecure Direct Object References IDOR Date: 2025-03-04 Exploit Author: Mehmet Can Kadıoğlu a.k.a mao7un Vendor:...

7.4AI score
SaveExploits0
Rows per page
Query Builder