CVE-2026-18315-PoC

CVE-2026-18315-PoC Proof-of-concept for CVE-2026-18315 TrueBooker = 1.2.6 WordPress Plugin: Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover...

EUVD-2026-110854

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7...

Doctor Near Telemedicine Premium Authentication Bypass

The vulnerability of the “Doctor Near. Telemedicine Premium” platform relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

QAFA Firmware Authentication Bypass

The vulnerability of the QAFA Firmware for telecommunications equipment relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the administrative web console...

CVE-2026-97255

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-97255

The Royal Elementor Addons plugin for WordPress (versions up to 1.7.1069 ) is vulnerable to an Authorization Bypass via user-controlled keys. The root cause involves Incorrectly Configured Access Control Security Levels , which allows for Insecure Direct Object References (IDOR) . An attacker can...

CVE-2026-97255 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-114698 WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1...

CVE-2026-114698

The WordPress myCred plugin (versions

CVE-2026-112868 WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9...

CVE-2026-112868

The WordPress H5P plugin (versions

CVE-2026-112861

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5...

CVE-2026-112861 WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.8.5...

CVE-2026-112861

The Participants Database plugin for WordPress (versions up to 2.7.8.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . This vulnerability is caused by an Authorization Bypass Through User-Controlled Key , where incorrectly configured access control security levels allow for unauth...

EUVD-2026-104326

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1...

CVE-2026-110901

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4...

EUVD-2026-102862

Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4...

EUVD-2026-102827

Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

PT-2026-115591

Name of the Vulnerable Software and Affected Versions SmartCrawl versions prior to 3.16.5 Description An authorization bypass exists due to a user-controlled key, which allows the exploitation of incorrectly configured access control security levels. Recommendations Update SmartCrawl to version...

EUVD-2026-102234

Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35...