Design/Logic Flaw

The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference...

CVE-2014-8356

The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference...

CVE-2014-8356

The web administrative portal in Zhone zNID 2426A before S3.0.501 allows remote authenticated users to bypass intended access restrictions via a modified server response, related to an insecure direct object reference. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...

eyecomms eyeCMS Insecure Direct Object Reference (IDOR) Vulnerability

eyecomms eyeCMS is a content management system CMS from eyecomms Oman. A security vulnerability exists in eyecomms eyeCMS 2019-10-15 and earlier versions. An attacker can exploit the vulnerability by modifying the 'id' parameter to modify personal information name, email, phone, resume and other...

CVE-2019-17604

An Insecure Direct Object Reference IDOR vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information first name, last name, email, CV, phone number, and all other personal information by changing the value of the candidate id the id...

CVE-2019-17604

An Insecure Direct Object Reference IDOR vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information first name, last name, email, CV, phone number, and all other personal information by changing the value of the candidate id the id...

Design/Logic Flaw

An Insecure Direct Object Reference IDOR vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information first name, last name, email, CV, phone number, and all other personal information by changing the value of the candidate id the id...

CVE-2019-17604

CVE-2019-17604 is an Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS up to 2019-10-15. An attacker can modify the id parameter to change other candidates’ personal information (e.g., first name, last name, email, CV, phone, etc.). The related Red Hat CVE-2019-17604 entry ...

Moneybird: IDOR in https://moneybird.com/user/accountant_company/edit(change company name)

Reporter found a way to change the name of an accountant company for which he didn't have permissions. We added extra checks to prevent these kind of Insecure Direct Object Reference bugs...

Input validation

An insecure direct object reference IDOR vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled...

WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting

Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Google Dork: inurl:/wp-content/themes/zoner/ Date: 2019-09-24 Exploit Author: m0ze Vendor Homepage: https://fruitfulcode.com/ Software Link:...

WordPress Zoner Real Estate Theme 4.1.1 Cross Site Scripting

Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Google Dork: inurl:/wp-content/themes/zoner/ Date: 2019-09-24 Exploit Author: m0ze Vendor Homepage: https://fruitfulcode.com/ Software Link:...

WordPress Zoner - Real Estate premium theme <= 4.1.1 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability found by Vlad Vector Ex.Mi in WordPress Zoner - Real Estate premium theme versions = 4.1.1. Solution Update the WordPress Zoner - Real Estate premium theme to the latest available version at least 4.2...

CVE-2016-10930

The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number...

Design/Logic Flaw

The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number...

CVE-2016-10930

The CVE-2016-10930 entry concerns the WordPress plugin WP Support Plus Responsive Ticket System. Affected component: the wp-support-plus-responsive-ticket-system plugin for WordPress. Root cause: insecure direct object reference via a ticket number in the plugin prior to version 7.1.0. Impact: po...

CVE-2016-10930

The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number...

Lojack’d: Pwning Smart vehicle trackers

This research is by @evstykas with help from @Yekki1 and @TheKenMunroShow. Many car insurers insist that smart trackers are fitted to high end vehicles. In the event of theft, the car can be tracked and recovered. Probably the most well-known is LoJack, also known as Tracker in Europe. We also...

Authorization Bypass

magento/community-edition is vulnerablbe to authorization bypass. The vulnerability exists through an Insecure Direct Object Reference IDOR that could allow unauthorized access to order details...

WordPress Real Estate 7 plugin <= 2.9.0 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability found by m0ze in WordPress Real Estate 7 plugin versions = 2.9.0. Solution 2019 August 6 - no information about patched version available...