CVE-2026-14313

The vulnerability CVE-2026-14313 affects the PeproDev WooCommerce Receipt Uploader WordPress plugin (versions up to 2.8.0). The issue is unauthenticated write access via IDOR (missing authorization) in the Receipt Uploader component, requiring WooCommerce to be present. The provided documents con...

CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

NPM: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Summary These endpoints accept a client-controlled credential parameter. The server loads credentials by id and uses them directly, without checking whether that credential belongs to the caller’s workspace. If an attacker knows another workspace’s credentialId, they can use that workspace’s Open...

CVE-2026-70472 Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise openai-assistants-vector-store endpoints accept a client-controlled credential parameter and load credentials by id without checking whether that credential belongs to the caller...

CVE-PoC-Hub — Updated!

🔬 CVE-PoC-Hub — Curated Proof-of-Concept Exploits Working, verified PoC scripts for recent CVEs. Tested in lab environments. For security researchers, penetration testers, and CTF players. ⚠️ Disclaimer All PoCs are for educational and authorized testing only. Each exploit has been tested in...

CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

CVE-2026-65501 WordPress Shiptastic for WooCommerce plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...

CVE-2026-65456

CVE-2026-65456 affects the WordPress plugin Product Slider for WooCommerce (versions

CVE-2026-28313

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking and arbitrary account takeover. The issue is described as higher impact on non‑Windows deployments and lower on Windows deployments. The CVSS 3.1 metrics (AV:N/AC:L/PR:H/UI:N/...

EUVD-2026-46286

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments...

GO-2026-5936 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers in github.com/zhenorzz/goploy

Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and projectfile handlers in github.com/zhenorzz/goploy...

CVE-2026-12393

The vulnerability CVE-2026-12393 affects the WPS Bookings for WooCommerce WordPress plugin prior to version 3.11.7. The root cause is that the plugin does not verify that a booking order belongs to the requesting user before cancellation, enabling any authenticated user (e.g., Subscriber/Customer...

GHSA-X8MG-6R4P-87PF ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

About 14 HTTP handlers resolve the database path param and call getDatabase... WITHOUT user.canAccessToDatabase... and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler which holds the only per-database gate at...

WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Daniel Wade in WordPress Plugin Easy Appointments versions = 3.12.27...

CVE-2026-12510 AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR

The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions...

PYSEC-2026-2935 PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API

Summary The PraisonAI Platform API has two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any...

PYSEC-2026-2328 Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)

Impact Aegra deployments running 0.9.0 through 0.9.6 with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated user User A, given another user's threadid User B, can: - Execute graph runs against User B's thread via POST /threads/threadid/runs...

PYSEC-2026-3423 wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data

Summary RepetitionsConfigViewSet and MaxRepetitionsConfigViewSet return all users' repetition config data because their getqueryset calls .all instead of filtering by the authenticated user. Any registered user can enumerate every other user's workout structure. Details...

CVE-2026-11963 User Registration & Membership < 5.2.2 - Subscriber+ Cross-User Role and Membership Tier Modification via IDOR

The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user, allowing any authenticated user such as a subscriber to change...