CVE-2025-3853

The WPshop 2 – E-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 2.0.0 to 2.6.0 via the callbackgenerateapikey due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above...

Authorization Bypass Through User-Controlled Key

Overview browser-use is a Make websites accessible for AI agents Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to the default settings disablesecurity=True and --remote-debugging-address=0.0.0.0. A remote attacker can execute arbitrary...

The vulnerability in the virtual learning environment Moodle, related to bypassing authentication using a user-controlled key, allows intruders to elevate their privileges and gain unauthorized access to protected information.

The vulnerability in the virtual learning environment Moodle relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an intruder to increase their privileges and gain unauthorized access to protected information...

PT-2025-55510

Уязвимость программного обеспечения для электронных торговых площадок CS-Cart Multi-Vendor связана с обходом авторизации посредством ключа, контролируемого пользователем. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на целостность и доступность...

CVE-2025-1284

The Woocommerce Automatic Order Printing | Formerly WooCommerce Google Cloud Print plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xcwooprinterpreview AJAX action due to missing validation on a user controlled key. This make...

CVE-2025-3247

The Contact Form 7 plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 6.0.5 via the 'wpcf7stripeskipspamcheck' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to reuse a single Stripe...

Authorization Bypass Through User-Controlled Key

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the revoke action process. An attacker can access sensitive user information and disrupt user access by exploiting improper access control...

Authorization Bypass Through User-Controlled Key

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to insufficient capability checks in the RSS block. An attacker can access and view additional RSS feeds by exploiting the IDOR vulnerability...

CVE-2025-3640: Authorization Bypass Through User-Controlled Key

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access...

CVE-2025-27561 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename "rooms" of arbitrary users...

CVE-2025-27561 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can rename "rooms" of arbitrary users...

CVE-2025-30257 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...

CVE-2025-30257

CVE-2025-30257 relates to Growatt Cloud portal authorization bypass through a user-controlled key. The included connected records confirm that unauthenticated attackers can retrieve the serial number of smart meters associated with a specific user account, indicating an information disclosure vul...

CVE-2025-31360 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...

CVE-2025-31360 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...

CVE-2025-31360

CVE-2025-31360 affects Growatt Cloud Applications (Growatt Cloud Portal). Multiple connected sources confirm an unauthenticated attacker can trigger device actions associated with specific “scenes” of arbitrary users, implying remote control of devices without user interaction. The vulnerability ...

CVE-2025-24850 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can export other users' plant information...

CVE-2025-24850 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An attacker can export other users' plant information...

CVE-2025-25276

CVE-2025-25276 relates to Growatt Cloud Applications (Growatt Cloud portal). Connected documents confirm an unauthenticated attacker can hijack other users’ devices and potentially take control, via vulnerabilities including an authorization bypass through a user-controlled key and improper input...

CVE-2025-27565

CVE-2025-27565 affects the Growatt Cloud Applications/Cloud portal. Multiple connected sources confirm an unauthenticated attacker can delete any user’s legitimate data by knowing the user ID and the target room ID, implying an authorization failure in manipulating user-controlled room resources....