CVE-2024-6410 ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pmuploadimage' function due to missing validation on a user controlled key. This makes it possible for authenticated...

WordPress ProfileGrid Plugin <= 5.8.9 is vulnerable to Insecure Direct Object References (IDOR)

Software ProfileGrid Type Plugin Vulnerable versions = 5.8.9 Fixed in 5.9.0 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-6410 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7aa3e6febe27 Credits Tieu Pham Trong...

CVE-2024-31898 IBM InfoSphere Information Server data modification

IBM InfoSphere Information Server 11.7 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references. IBM X-Force ID: 288182...

CVE-2024-5942

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'contentclone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access...

CVE-2024-5942

CVE-2024-5942 affects the WordPress Page and Post Clone plugin. The issue is an Insecure Direct Object Reference in the content_clone function due to missing validation on a user-controlled key, enabling authenticated attackers with Author+ access to clone and read private posts. Technical detail...

CVE-2024-5942 Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'contentclone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access...

CVE-2024-5942 Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'contentclone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access...

WordPress Paid Memberships Pro Plugin <= 3.0.4 is vulnerable to Insecure Direct Object References (IDOR)

Software Paid Memberships Pro Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-37277 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID dc85580f8dca Credits Rafie...

WordPress Bricks Builder plugin <= 1.9.8 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Francesco Carlucci in WordPress Plugin Bricks Builder Premium versions = 1.9.8...

WordPress Bricks Builder (Premium) Plugin <= 1.9.8 is vulnerable to Insecure Direct Object References (IDOR)

Software Bricks Builder Premium Type Plugin Vulnerable versions = 1.9.8 Fixed in 1.9.9 OWASP Top 10 A5: Security Misconfiguration Classification Insecure Direct Object References IDOR CVE CVE-2024-4874 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 25f017e35793 Credits...

VulnNodeApp - A Vulnerable Node.Js Application

A vulnerable application made using node.js, express server and ejs template engine. This application is meant for educational purposes only. Setup Clone this repository git clone https://github.com/4auvar/VulnNodeApp.git Application setup: Install the latest node.js version with npm. Open...

CVE-2024-4874

The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-4874 Bricks Builder <= 1.9.8 - Insecure Direct Object Reference

The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-4874

CVE-2024-4874 affects Bricks Builder for WordPress (Bricks Builder plugin) up to version 1.9.8. It is an Insecure Direct Object Reference via postId due to missing validation on a user-controlled key, enabling authenticated attackers with Contributor-level access and above to modify posts and pag...

CVE-2024-4874 Bricks Builder <= 1.9.8 - Insecure Direct Object Reference

The Bricks Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.9.8 via the postId parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-5639

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'restapichangeprofileimage' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-5639 User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'restapichangeprofileimage' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-5639

CVE-2024-5639 : The WordPress User Profile Picture plugin (metronet-profile-picture) suffers an Insecure Direct Object Reference in all versions up to and including 2.6.1 due to missing validation in rest_api_change_profile_image. This allows authenticated attackers with Author-level access or hi...

CVE-2024-5639 User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'restapichangeprofileimage' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-38874

The CVE-2024-38874 issue affects the TYPO3 Events 2 extension (events2) prior to 8.3.8 and prior to 9.0.6 for TYPO3. The root cause is missing access checks in the management plugin, creating an insecure direct object reference (IDOR). This could allow an unauthenticated attacker to activate or d...