669 matches found
foreUP golf management platform's web API contains multiple vulnerabilities
Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
EUVD-2026-49215
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Paid Member Subscriptions versions = 3.0.7...
EUVD-2026-48112
Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...
CVE-2026-65501
Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...
CVE-2026-57680
CVE-2026-57680 affects the WordPress Kirki plugin versions
CVE-2026-57680
Unauthenticated Insecure Direct Object References IDOR in Kirki = 6.0.11 versions...
CVE-2026-57680 WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Kirki = 6.0.11 versions...
CVE-2026-57676 WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple User Avatar: from n/a through 4.9...
EUVD-2025-210356
Unauthenticated Insecure Direct Object References IDOR in BookPro = 1.1.0 versions...
CVE-2026-57665
Unauthenticated Insecure Direct Object References IDOR in GravityView = 3.0.0 versions...
CVE-2026-56048
Unauthenticated Insecure Direct Object References IDOR in Payment Gateway Based Fees and Discounts for WooCommerce = 3.0.0 versions...
CVE-2026-54826
Subscriber Insecure Direct Object References IDOR in SupportCandy = 3.4.6 versions...
CVE-2025-66123
Unauthenticated Insecure Direct Object References IDOR in BookPro = 1.1.0 versions...
EUVD-2026-39670
Unauthenticated Insecure Direct Object References IDOR in GravityView = 3.0.0 versions...