CVE-2025-65096

RomM (ROM Manager) prior to versions 4.4.1 and 4.4.1-beta.2 is vulnerable to Insecure Direct Object Reference (IDOR): an API access flaw that allows reading private or smart collections belonging to other users by directly supplying collection IDs, due to missing ownership verification/public/pri...

CVE-2025-65096 RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections

RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership...

CVE-2025-65096 RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections

RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership...

CVE-2025-65096 RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections

RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership...

CVE-2025-13109

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woofaddquery" and "woofremovequery" functions due to missing validation on a user controlled key. This makes it...

CVE-2025-13109 HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woofaddquery" and "woofremovequery" functions due to missing validation on a user controlled key. This makes it...

Vulnerability of the function dc_dmub_srv_optimized_init_done() in the driver/gpu/drm/amd/display/dc/dc_dmub_srv.c file – This is a driver for supporting Direct Rendering Infrastructure (DRI) in AMD graphics cards for Linux operating systems. It allows a hacker to cause a service failure.

Vulnerability of the dcdmubsrvoptimizedinitdone function in the drivers/gpu/drm/amd/display/dc/dcdmubsrv.c file – The drivers for AMD graphics cards that support Direct Rendering Infrastructure DRI in Linux operating systems are vulnerable due to improper control of resource identifiers “resource...

Vulnerability of the intel_hdcp_read_valid_bksv() function in the driver/gpu/drm/i915/display/intel_hdcp.c module – This driver is part of the Linux kernel’s Direct Rendering Infrastructure (DRI) support mechanism. An attacker can exploit this vulnerability to cause a service failure.

Vulnerability of the intelhdcpreadvalidbksv function in the driver/gpu/drm/i915/display/intelhdcp.c module – The Linux DRI driver is vulnerable due to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Vulnerability of the dcn21_set_backlight_level() function in the drivers/gpu/drm/amd/display/dc/dcn21/dcn21HWSeq.c module – This driver is part of the Linux kernel’s Direct Rendering Infrastructure (DRI) support for AMD graphics cards. It allows a malicious actor to cause a system failure.

Vulnerability of the dcn21setbacklightlevel function in the drivers/gpu/drm/amd/display/dc/dcn21/dcn21HWSeq.c module – The drivers for AMD graphics cards that support Direct Rendering Infrastructure DRI in Linux operating systems rely on pointer swapping. Exploiting this vulnerability could allow...

📄 EduplusCampus 3.0.1 Insecure Direct Object Reference

A critical insecure direct object reference vulnerability was identified in the EduplusCampus student portal version 3.0.1. This vulnerability allows an authenticated user to access the sensitive personal and financial records of other students by modifying the recno parameter in the API request...

Vulnerability of the intel_dp_hdcp2_get_capability() function in the drivers/gpu/drm/i915/display/intel_dp_hdcp.c module – A driver for supporting Linux’s Direct Rendering Infrastructure (DRI), which allows a hacker to trigger a service failure.

Vulnerability of the inteldphdcp2getcapability function in the drivers/gpu/drm/i915/display/inteldphdcp.c module – The Linux DRI driver is vulnerable due to pointer manipulation issues. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-66306

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR Insecure Direct Object Reference vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin emai...

EUVD-2025-200146

In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538...

CVE-2025-20789

In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS10117741; Issue ID: MSV-4538...

EUVD-2025-200104

Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel...

CVE-2025-66306

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR Insecure Direct Object Reference vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin emai...

CVE-2025-66306 Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR Insecure Direct Object Reference vulnerability in the Grav CMS Admin Panel which allows low-privilege users to access sensitive information from other accounts. Although direct account takeover is not possible, admin emai...

CVE-2025-66306

CVE-2025-66306 describes an Insecure Direct Object Reference (IDOR) in Grav CMS Admin Panel prior to 1.8.0-beta.27. The vulnerability allows low-privilege authenticated users to access information from other accounts via endpoints such as /admin/accounts/users/{username}, potentially exposing adm...

WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Rooting in WordPress Plugin Contact Form Email versions = 1.3.60...

CVE-2025-65670

An Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts t...