1079 matches found
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Jakub Herman in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...
PT-2026-71514
Name of the Vulnerable Software and Affected Versions Do Lasso versions prior to 359 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user controlled key. This allows unauthenticated attackers to perform unauthorized actions. Recommendations Update to a...
CVE-2026-66692
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-28180
Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...
CVE-2026-66692
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
EUVD-2026-53900
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
EUVD-2026-53970
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...
CVE-2026-28180 WordPress Mercado Pago payments for WooCommerce plugin <= 8.9.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...
EUVD-2026-53952
Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...
CVE-2026-28180
The CVE describes an unauthenticated Insecure Direct Object References (IDOR) vulnerability in the Mercado Pago payments for WooCommerce plugin for WordPress, affecting versions
CVE-2026-69094
Admidio before 5.0.11 is affected by CVE-2026-69094: an insecure direct object reference in the save_temporary mode of mylist_function.php allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users’ p...
foreUP golf management platform's web API contains multiple vulnerabilities
Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check...
WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by TurboNexic in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.10.0...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
EUVD-2026-49215
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...