CVE-2025-3292

CVE-2025-3292 concerns the WordPress plugin “User Registration & Membership – Custom Registration Form, Login Form, and User Profile.” It is vulnerable to Insecure Direct Object Reference due to missing validation on the user_id parameter, enabling update of other users’ passwords when an attacke...

CVE-2025-3292 User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the userregistrationupdateprofiledetails due to missing validation on the 'userid' use...

WordPress plugin User Registration & Membership 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-16168 · WordPress · User Registration & Membership

Name of the Vulnerable Software and Affected Versions: User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions up to, and including, 4.1.3 Description: The issue allows unauthenticated attackers to update other users' passwords if they...

WordPress User Registration plugin <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification vulnerability

Insecure Direct Object Reference to Unauthenticated Membership Modification vulnerability discovered by wesley wcraft in WordPress Plugin User Registration versions = 4.1.3...

WordPress User Registration plugin <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ User Password Update vulnerability discovered by wesley wcraft in WordPress Plugin User Registration versions = 4.1.3...

CVE-2025-32367

The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions...

Reimagining Democracy

Imagine that all of us--all of society--have landed on some alien planet and need to form a government: clean slate. We do not have any legacy systems from the United States or any other country. We do not have any special or unique interests to perturb our thinking. How would we govern ourselves...

CVE-2025-32367

The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions...

Oz Forensics Oz Liveness 安全漏洞

Oz Forensics Oz Liveness is a leading facial recognition and authentication software from Oz Forensics. A security vulnerability exists in Oz Forensics Oz Liveness versions prior to 4.0.8 late 2023, which stems from an insecure direct object reference that could lead to PII retrieval...

CVE-2025-32367

CVE-2025-32367 affects the Oz Forensics face recognition application prior to version 4.0.8 (late 2023). The root cause is an Insecure Direct Object Reference flaw in the /statistic/list endpoint, which could allow retrieval of PII. Public references from NVD/Red Hat describe the vulnerability, w...

CVE-2025-32367

The Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via /statistic/list Insecure Direct Object Reference. NOTE: the number 4.0.8 was used for both the unpatched and patched versions...

Moodle 4.4.x < 4.4.2 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.12, 4.2.x prior to 4.2.9, 4.3.x prior to 4.3.6, or 4.4.x prior to 4.4.2. It is, therefore, affected by multiple vulnerabilities. - A LFI vulnerability when restoring malformed block backups....

The vulnerability of the drm/dp_mst component in the Linux operating system allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the drm/dpmst component in the Linux operating system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the DRM/V3D component in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the DRM/V3D component in the Linux operating system is related to the exhaustion of file descriptors. Exploiting this vulnerability can allow a hacker to cause a service failure...

Moodle 4.4.x < 4.4.4 Multiple Insecure Direct Object Reference

According to its self-reported version, the Moodle install hosted on the remote host is 4.4.x prior to 4.4.4. It is, therefore, affected by multiple insecure direct object reference. - An IDOR when accessing list of badge recipients. - An IDOR when accessing list of course badges. Note that the...

The vulnerability of the DRM/AMD/display components in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the DRM/amd/display components in the Linux operating system is related to pointer assignment errors. Exploiting this vulnerability can allow an attacker to cause a service failure...

Bykea: IDOR on in-app hardcoded zombie endpoint

The researcher discovered an Insecure Direct Object Reference IDOR vulnerability in a hardcoded legacy zombie endpoint that was no longer actively used but remained accessible. By reverse engineering the Android app and reviewing the code for unused endpoints, the sensitive details related to...

Vulnerability of the tp_func_xe_bo_move_name() function in the drivers/gpu/drm/xe/xeTraceBo.h module – The driver for supporting Direct Rendering Infrastructure (DRI) in the Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

Vulnerability of the tpfuncxebomovename function in the drivers/gpu/drm/xe/xeTraceBo.h module – The driver for supporting Direct Rendering Infrastructure DRI in Linux kernels involves the reutilization of previously released memory. Exploiting this vulnerability could allow attackers to compromis...

PT-2025-29033

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A double-free issue was identified in the fsl-mc bus driver within the Linux kernel. A commit intended to simplify deallocation procedures inadvertently introduced a double-free on the...