CVE-2025-34438

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

EUVD-2025-203956

AVideo versions prior to 20.0 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

CVE-2025-34438

Summary: CVE-2025-34438 affects AVideo versions prior to 20.1. It is an insecure direct object reference (IDOR) where users with upload permissions can modify the rotation metadata of arbitrary videos because the endpoint verifies upload capability but fails to enforce ownership/administrative ri...

CVE-2025-34435

AVideo

CVE-2025-34435 AVideo < 20.1 IDOR Arbitrary File Deletion

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference IDOR that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video...

CVE-2025-34436 AVideo < 20.1 IDOR Arbitrary File Upload

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...

CVE-2025-67165

An Insecure Direct Object Reference IDOR in Pagekit CMS v1.0.18 allows attackers to escalate privileges...

EUVD-2025-203882

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the ninja-forms-views REST endpoints...

📄 Institute Admission Software 2.5 Insecure Direct Object Reference

Institute Admission Software version 2.5 suffers from an insecure direct object reference vulnerability. ============================================================================================================================================= | Title : Institute Admission Software 2.5 IDOR...

PT-2025-51890

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 contain an insecure direct object reference issue. Users with upload permissions can modify the rotation metadata of any video. The ''/video/id'' endpoint verifies upload...

CVE-2025-34438: Authorization Bypass Through User-Controlled Key

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

Pagekit 安全漏洞

Pagekit is a modular, lightweight CMS Content Management System from Pagekit Open Source. A security vulnerability exists in Pagekit version 1.0.18, which stems from the presence of an insecure direct object reference that could lead to elevation of privilege...

PT-2025-51887

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 are susceptible to an insecure direct object reference IDOR that permits any authenticated user to delete media files owned by other users. The affected endpoint confirms...

CVE-2025-11924: Authorization Bypass Through User-Controlled Key

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the ninja-forms-views REST endpoints...

VulnCheck KEV: CVE-2025-11924

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the ninja-forms-views REST endpoints...

PT-2025-51846

Name of the Vulnerable Software and Affected Versions Pagekit CMS version 1.0.18 Description An Insecure Direct Object Reference IDOR exists in Pagekit CMS version 1.0.18, potentially allowing attackers to escalate privileges. An IDOR occurs when an application uses user-supplied input to directl...

PT-2025-51888

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 AVideo versions prior to 20.0 Description AVideo versions prior to 20.1 have a flaw where authenticated users can upload files into directories owned by other users. This is due to an insecure direct object...

CVE-2025-34436: Authorization Bypass Through User-Controlled Key

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks...

CVE-2025-67985 WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Document Library Lite: from n/a through = 1.1.7...

CVE-2025-13003

CVE-2025-13003 describes an Authorization Bypass Through User-Controlled Key in AxOnboard (Aksis Computer Services and Consulting Inc.), affecting version 3.2.0 up to 3.3.0. The root cause is not detailed beyond the user-controlled key enabling exploitation of trusted identifiers. Documented impa...