CVE-2026-5060 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

CVE-2026-63241

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

EUVD-2026-50136

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2025-60931

An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...

CVE-2026-63241: Authorization Bypass Through User-Controlled Key

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2025-60931

An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...

CVE-2026-14926

The FluentCart A New Era of eCommerce WordPress plugin, in versions before 1.4.0 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify that a subscription belongs to the requesting customer across several payment-method endpoints . This oversight allows an...

CVE-2026-16797 ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

CVE-2026-16797

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

CVE-2026-16797: Authorization Bypass Through User-Controlled Key

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

PT-2026-65400

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.5 via the 'optionSection' parameter due to missing validation on a user controlled key. This makes it possible...

CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

CVE-2026-59240 IDOR in Prospero Flow CRM allows deletion of other users' notifications

The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...

CVE-2026-59539

CVE-2026-59539 affects the WordPress plugin Paid Member Subscriptions (versions

Vulnerabilities Fixed in SolarWinds Serv-U

SolarWinds has addressed several vulnerabilities in Serv-U. The vulnerabilities in SolarWinds Serv-U primarily involve insecure direct object reference IDOR and broken access control. These vulnerabilities allow attackers with certain privileges—such as domain administrator or group administrator...

CSFR-XSS-IDOR

OWASP Juice Shop Security Testing A practical security assess...

Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Affected software - Product: Poweradmin web front-end for PowerDNS - Version tested: master, commit 7f28c3a97 also reachable in the 4.x release line — the record-edit code is the same - Component: record editing web UI - Vulnerability type: Broken Access Control / Insecure Direct Object Reference...

GHSA-RM67-G9CH-VXFF Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not own

Affected software - Product: Poweradmin web front-end for PowerDNS - Version tested: master, commit 7f28c3a97 also reachable in the 4.x release line — the record-edit code is the same - Component: record editing web UI - Vulnerability type: Broken Access Control / Insecure Direct Object Reference...

CVE-2026-65708

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...