30327 matches found
EUVD-2025-203882
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the ninja-forms-views REST endpoints...
CVE-2025-53398
The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...
ProjectSend 安全漏洞
ProjectSend cFTP is the ProjectSend open source suite of self-hosted applications based on PHP and MySQL. A security vulnerability exists in ProjectSend r1605 that originates from an unauthenticated attacker who can download private files by manipulating the download ID parameter, which could lea...
CVE-2025-67168
RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords...
CVE-2025-67168
RiteCMS v3.1.0 is affected by CVE-2025-67168 due to insecure password storage via weak encryption. Multiple sources (NVD, Red Hat, EUVD, CNVD, OSV, CNVD) describe the issue consistently; root cause is insecure password encryption, with impact limited to confidentiality (C: Low) and no integrity/a...
CVE-2025-67165
An Insecure Direct Object Reference IDOR in Pagekit CMS v1.0.18 allows attackers to escalate privileges...
Gladinet CentreStack < 16.4.10315.56368 Insecure Deserialization
According to its banner, the version of Gladinet CentreStack running on the remote host is prior to 16.4.10315.56368. It is, therefore, affected by an Insecure Deserialization due to the CentreStack portal's use an hardcoded machineKey. Note that the scanner has not tested for these issues but ha...
RiteCMS 安全漏洞
RiteCMS is an open source content management system based on php and sqlite. An unspecified vulnerability exists in RiteCMS that stems from the use of insecure encryption to store passwords. No detailed vulnerability details are provided at this time...
PT-2025-51846
Name of the Vulnerable Software and Affected Versions Pagekit CMS version 1.0.18 Description An Insecure Direct Object Reference IDOR exists in Pagekit CMS version 1.0.18, potentially allowing attackers to escalate privileges. An IDOR occurs when an application uses user-supplied input to directl...
PT-2025-51890
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 contain an insecure direct object reference issue. Users with upload permissions can modify the rotation metadata of any video. The ''/video/id'' endpoint verifies upload...
PT-2025-51843
Name of the Vulnerable Software and Affected Versions Portrait Dell Color Management application version 3.3.8 Description The Portrait Dell Color Management application for Dell monitors exhibits Insecure Permissions. Recommendations At the moment, there is no information about a newer version...
📄 Institute Admission Software 2.5 Insecure Direct Object Reference
Institute Admission Software version 2.5 suffers from an insecure direct object reference vulnerability. ============================================================================================================================================= | Title : Institute Admission Software 2.5 IDOR...
CVE-2025-53398
CVE-2025-53398 affects Portrait Displays Dell Color Management application 3.3.8 for Dell monitors. The root cause is insecure permissions on a temporary folder created during a custom installation path, enabling a local, low-privilege attacker to achieve elevated system privileges. The exploit i...
PT-2025-51888
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 AVideo versions prior to 20.0 Description AVideo versions prior to 20.1 have a flaw where authenticated users can upload files into directories owned by other users. This is due to an insecure direct object...
PT-2025-51887
Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 are susceptible to an insecure direct object reference IDOR that permits any authenticated user to delete media files owned by other users. The affected endpoint confirms...
CVE-2025-53398
The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,...
PT-2025-51968
Name of the Vulnerable Software and Affected Versions ProjectSend version r1605 Description An insecure direct object reference issue exists in ProjectSend r1605. An unauthenticated attacker can download private files by manipulating the id parameter in a download request to the 'process.php'...
VulnCheck KEV: CVE-2025-11924
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the ninja-forms-views REST endpoints...