CVE-2025-11518

The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via several wishlist AJAX functions due to missing validation on a user controlled key that is exposed when wishlists are shared. This makes it...

WordPress plugin WPC Smart Wishlist for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

EUVD-2025-32714

Insecure Direct Object Reference IDOR in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure BBMRI-ERIC. This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in...

CVE-2025-40676

CVE-2025-40676 affects Negotiator v3.15.2 from BBMRI-ERIC. The vulnerability is an insecure direct object reference (IDOR) in the userID parameter of the /api/v3/users/ endpoint, enabling an attacker to access or modify unauthorised resources and potentially expose or alter sensitive data. The CV...

EUVD-2019-5872

Malware in sbrugna...

EUVD-2019-5873

Malware in sbrugna...

EUVD-2019-5874

Malware in sbrugna...

EUVD-2019-5875

Malware in sbrugna...

EUVD-2019-5869

Malware in sbrugna...

EUVD-2019-5868

Malware in sbrugna...

EUVD-2019-5876

Malware in sbrugna...

EUVD-2021-20652

Malware in sbrugna...

EUVD-2019-5485

Malware in sbrugna...

EUVD-2019-5870

Malware in sbrugna...

EUVD-2021-11412

Malware in sbrugna...

EUVD-2019-5877

Malware in sbrugna...

EUVD-2018-11267

Malware in sbrugna...

EUVD-2019-5486

Malware in sbrugna...

CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list

OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...

CVE-2025-10696

CVE-2025-10696 affects OpenSupports 4.11.0. An endpoint allows editing the list of 'supervised users' for any account without verifying ownership, enabling a Level 1 staff member to modify the supervision relationship of a target user. This can let the target view tickets belonging to the added s...