1077 matches found
CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...
Tiredful-API
ไปไนๆฏ Tiredful API๏ผ Tiredful API ๆฏไธไธชๆ ๆ่ฎพ่ฎกๅญๅจๆผๆด็ๅบ็จใๆฌ Web ๅบ็จๆจๅจๅธฎๅฉๅผๅ่ ใQA ๆๅฎๅ จไธไธไบบๅไบ่งฃ็ฑไบไธๅฎๅ จ็็ผ็ ๅฎ่ทต่ๅฏผ่ด็ Web ๆๅก๏ผREST API๏ผไธญ็็ผบ้ทใ ่ฐๅฏไปฅไฝฟ็จ Tiredful API๏ผ Web ๅผๅ่ Web ๆธ้ๆต่ฏไบบๅ ๅฎๅ จไธไธไบบๅ ๅญฆ็ Tiredful API ๅ ๅซๅชไบๅ ๅฎน๏ผ ๆๅฐ่ฏ่ฆ็ไบๅคง้จๅๆผๆด๏ผไฝๆ็กฎไฟกๆไปฌ่ฟ้ๆผไบไธไบๆผๆดใๅฆๆไฝ ็ฅ้ไปปไฝ้ๅๅ ๅซๅจๅ ถไธญ็่ฏๅฅฝๆผๆด๏ผ่ฏทไธๆ่็ณปใ็ฎๅ๏ผๆๅ ๅซไบไปฅไธๆผๆด๏ผ ไฟกๆฏๆณ้ฒ ไธๅฎๅ จ็็ดๆฅๅฏน่ฑกๅผ็จ ่ฎฟ้ฎๆงๅถ ้ๆต SQL ๆณจๅ ฅ๏ผSQLite๏ผ ่ทจ็ซ่ๆฌ...
CVE-2026-35678
ๆผๆด็ ็ฉถๆฅๅ๏ผAll Eduplus ๅญฆ็ ERP ไธๅฎๅ จ็็ดๆฅๅฏน่ฑกๅผ็จ๏ผIDOR๏ผ ็ ็ฉถไบบๅ๏ผVinay Sharma 1. ๆง่กๆ่ฆ ๆฌๆฅๅ่ฏฆ็ปไป็ปไบๅจ Eduplus ๅญฆ็ ERP ๅนณๅฐไธญๅ็ฐ็ไธไธช้ซไธฅ้ๆงๅฎๅ จๆผๆด๏ผๅ ทไฝไฝไบๅญฆ็ๅญฆไน ่ ้จๆท๏ผlearnerapi.pceterp.in๏ผไธญใ่ฏฅๅบ็จ็จๅบๅจ่่ฏ่กจๅๆไบค็ซฏ็นไธๅญๅจ้็จไธๅฎๅ จ็็ดๆฅๅฏน่ฑกๅผ็จ๏ผIDOR๏ผๆผๆด๏ผๅ ่ฎธไปปไฝๅทฒ่ฎค่ฏ็จๆท๏ผๅญฆ็๏ผ้่ฟๆ็บต่กจๅๆ ่ฏ็ฌฆๆฅๆฃ็ดขไปปไฝๅ ถไปๅญฆ็็ๆๆไธชไบบๅ่ดขๅกๆฐๆฎใ ่ฏฅๆผๆดๅ ่ฎธๅคง่งๆจกๆถ้ๅญฆ็่ฎฐๅฝๆฐๆฎ๏ผๅ ๆฌไธชไบบ่บซไปฝไฟกๆฏ๏ผPII๏ผๅ่ฏฆ็ป็่ดขๅกไบคๆๅฎก่ฎก่ท่ธชใ 2. ๆผๆด่ฏฆๆ ็ฎๆ ไธปๆบ๏ผ...
CVE-2024-11318
CVE-2024-11318 IDOR - AbsysNet 2.3.1 ็จๆทๅซๆ ๅ ่ดฃๅฃฐๆ ๆญคๅทฅๅ ทๆจๅจๅธฎๅฉ่ฏๅซๅๅฉ็จ็นๅฎCVE-2024-11318ๆผๆด็ๅบ็จ็จๅบๆฏๅฆๆๅๆปๅปใๅฎ้็จไบ็ฝ็ปๅฎๅ จไธไธไบบๅใ็ ็ฉถไบบๅๅๆธ้ๆต่ฏไบบๅ๏ผๅจ่ทๅพๆ็กฎๆๆ็ๆ ๅตไธ่ฏไผฐ็ฏๅข็ๅฎๅ จๆงใ ๅฆๆ็กฎ่ฎคๅญๅจๆผๆด๏ผไป ๅฝๆจๆฅๆๅบ็จ็จๅบๆ็ณป็ปๆๆ่ ็้ๅฝๆๆๆถ๏ผๆ่ฝ่ฟ่กๅฉ็จใ ๆช็ปๆๆไฝฟ็จๆญคๅทฅๅ ท้ๅฏนๆจไธๆฅๆๆๆช็ปๆ็กฎ่ฎธๅฏๆต่ฏ็็ณป็ปๆ็ฝ็ปๆฏ้ๆณไธไธ้ๅพท็ใไฝ่ ๅฏนๆญคๅทฅๅ ท้ ๆ็ไปปไฝๆปฅ็จๆๆๅฎณไธๆฟๆ ไปปไฝ่ดฃไปปใ ไฝฟ็จๆญคๅทฅๅ ทๅณ่กจ็คบๆจๅๆ้ตๅฎๆๆ็ธๅ ณๆณๅพๅ้ๅพทๆ ๅใๅจๆต่ฏๆๅฉ็จๆผๆดไนๅ๏ผ่ฏทๅง็ป็กฎไฟๆจๆฅๆๆ็กฎ่ฎธๅฏใ ๆ่ฟฐ ่ฏฅๆผๆดๅฝฑๅ...
CVE-2026-3235
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...
CVE-2026-3235 WP Data Access โ No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...
OpenMRS Platform < 2.24.0 - Insecure Object Deserialization
OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. id: CVE-2018-19276 info: name: OpenMRS Platform 2.24.0 - Insecure Object...
CVE-2026-73189
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858...
WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Modal Survey versions = 2.0.2.2.3...
CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...
CVE-2026-67622
Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...
CVE-2026-67622
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...
CVE-2026-19111
CVE-2026-19111 affects Amazon Strands Agents Toolsโ memory tools (mongodb_memory, elasticsearch_memory, mem0_memory) prior to 0.8.3. The issue is an insecure direct object reference that could allow remote authenticated users to access, modify, or delete memories belonging to other tenants by pro...
CVE-2026-28180
Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...
EUVD-2026-53900
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Mรฉthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-65523
CVE-2026-65523 affects the WordPress plugin Formidable Forms Signature Online Contract Automation (versions
CVE-2026-65523
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...
CVE-2026-16070
The CVE-2026-16070 relates to the Brizy WordPress plugin (before 2.8.19). The vulnerability arises because it does not properly verify authorization when updating a templateโs type meta, validating a request parameter different from the one used in the write operation. This IDOR-like flaw enables...
CVE-2026-69094
Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...
CVE-2026-69094
Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...