CVE-2024-12014 Path Traversal vulnerability in eSignaViewer Allow Unauthorized File Access

Path Traversal vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers...

PT-2025-3275 · One Identity · One Identity Identity Manager

Name of the Vulnerable Software and Affected Versions: One Identity Identity Manager versions prior to 9.3 Description: An insecure direct object reference IDOR issue allows privilege escalation. Only On-Premise installations are affected. The vulnerability can be exploited by a remote attacker t...

PT-2024-36526 · Unknown · Oqtane Framework

Name of the Vulnerable Software and Affected Versions: Oqtane Framework affected versions not specified Description: The issue is related to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController, allowing unauthorized users to access sensitive information of other users by...

CVE-2024-55471

Oqtane Framework is vulnerable to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter...

CVE-2024-55471

Oqtane Framework is vulnerable to Insecure Direct Object Reference IDOR in Oqtane.Controllers.UserController. This allows unauthorized users to access sensitive information of other users by manipulating the id parameter...

Oqtane Framework security vulnerabilities

Oqtane Framework is an open source content management system CMS and application framework from Oqtane Open Source. A security vulnerability exists in Oqtane Framework version 6.0.0, which stems from an insecure direct object reference that allows a logged-in user to access other user's messages ...

CVE-2024-55186

An IDOR Insecure Direct Object Reference vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging...

CVE-2024-55471

The Oqtane Framework (an open-source CMS and application framework) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the Oqtane.Controllers.UserController component. The vulnerability exists because certain endpoints do not enforce sufficient authorization checks to validate th...

SUSE CVE-2024-46528

An Insecure Direct Object Reference IDOR vulnerability in KubeSphere 4.x before 4.1.3 and 3.x through 3.4.1 and KubeSphere Enterprise 4.x before 4.1.3 and 3.x through 3.5.0 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks...

Online Birth Certificate System Insecure Direct Object Reference Vulnerability

Online Birth Certificate System is an online birth certificate system. The Online Birth Certificate System suffers from an insecure direct object reference vulnerability that stems from a lack of proper authorization checking of the viewid parameter in the /user/view-application-detail.php file. ...

PHPGurukul Online Notes Sharing Management System Security Vulnerabilities

PHPGurukul Online Notes Sharing Management System is an online notes sharing management system from PHPGurukul Inc. A security vulnerability exists in PHPGurukul Online Notes Sharing Management System v1.0, which stems from a lack of authorization checking and an IDOR vulnerability that allows...

CodeAstro Complaint Management System Security Vulnerabilities

CodeAstro Complaint Management System is a complaint management system from CodeAstro. A security vulnerability exists in CodeAstro Complaint Management System v1.0, which stems from an IDOR vulnerability that can be exploited to execute arbitrary code and obtain sensitive information by modifyin...

CVE-2024-55058

An insecure direct object reference IDOR vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerability resides in the viewid parameter of /user/view-application-detail.php. Authenticated users can exploit this flaw by manipulating the viewid parameter in the...

PHPGurukul Online Birth Certificate System has a security vulnerability

Online Birth Certificate System is an online birth certificate system. The Online Birth Certificate System suffers from an insecure direct object reference vulnerability that stems from a lack of proper authorization checking of the viewid parameter in the /user/view-application-detail.php file. ...

CVE-2024-55058

The PHPGurukul Online Birth Certificate System v1.0 is affected by an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists in the viewid parameter of the /user/view-application-detail.php file due to a lack of proper authorization checks. This allows authenticated users to acces...

CVE-2024-55058

An insecure direct object reference IDOR vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0. This vulnerability resides in the viewid parameter of /user/view-application-detail.php. Authenticated users can exploit this flaw by manipulating the viewid parameter in the...

CVE-2024-12447

The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-12447 Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode

The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

CVE-2024-12447

CVE-2024-12447 is a vulnerability in the Get Post Content Shortcode plugin for WordPress, affecting all versions up to 0.4. It enables Insecure Direct Object Reference via the post_content shortcode due to missing validation on a user-controlled key, allowing authenticated attackers with Contribu...

PT-2024-17596 · WordPress · Get Post Content Shortcode

Name of the Vulnerable Software and Affected Versions: Get Post Content Shortcode plugin for WordPress versions up to, and including, 0.4 Description: The issue is related to Insecure Direct Object Reference. This is due to missing validation on a user-controlled key in the 'post-content'...