EUVD-2026-97013

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query...

CVE-2026-108862 APIPark through 1.9.7-beta IDOR via application authorization endpoints

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query...

CVE-2026-108854

Wanwu versions prior to 0.6.3 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. An authenticated enabled user can delete other users' legacy AppKeys by providing a numeric apiId to the DELETE /v1/appspace/app/key endpoint. This flaw allows attackers to iterate sequential...

CVE-2026-108854 Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across...

CVE-2026-108853 UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assista...

CVE-2026-108853

Versions of UnicomAI Wanwu prior to 0.6.3 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. Authenticated low-privileged users can delete other tenants' agent or RAG applications by sending requests to the DELETE /v1/appspace/app endpoint with guessed sequential assistan...

CVE-2026-108853 UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assista...

CVE-2023-5808

CVE-2023-5808 CVE-2023-5808 is an Insecure Direct Object Reference IDOR in vulnerability found in Hitachi NAS' HNAS' System Management Unit SMU Backup & Restore functionality. This vulnerability affects SMU versions prior to 14.8.7825.01. Exploitation This exploit requires the attacker to have...

CVE-2015-6668

CVE-2015-6668 Evangelos Mourikis POC for CVE-2015-6668 converted for Python 3 Exploits IDOR vulnerability in Job Manager plugin for Wordpress. Tested on Python 3.11.9 References NIST CVE WPScan Vuln DB Setup and Usage Clone the repo, setup virtual environment if desired, install requests, and run...

CVE-2026-8347

CVE-2026-8347 – Insecure Direct Object Reference IDOR in Concrete CMS Overview CVE-2026-8347 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS versions 9.5.0 and earlier. The issue exists in the Express Association Reorder functionality due to insufficient...

CVE-2025-12585

MxChat Basic = 2.5.1 - MxChat – AI Chatbot for WordPress = 2.5.1 - Unauthenticated Information Exposure The MxChat Basic plugin does not verify session ownership in the mxchatfetchconversationhistory AJAX endpoint, allowing unauthenticated users to access other users' conversation history and IP...

CVE-2026-8239

CVE-2026-8239 CVE-2026-8239 is an Insecure Direct Object Reference IDOR vulnerability affecting Concrete CMS 9.5.0 and earlier.The vulnerability exists in the /ccm/frontend/conversations/getrating endpoint, which allows an attacker to determine whether a conversation message exists and retrieve i...

CVE-2026-8237

CVE-2026-8237 CVE-2026-8237 is an Insecure Direct Object Reference IDOR vulnerability caused by missing authorization checks in Concrete CMS 9.5.0 and earlier.The flaw exists in the /ccm/frontend/conversations/messagedetail endpoint, which returns the full contents of conversation messages based...

CVE-2026-104684

The Envira Gallery WordPress plugin, in versions prior to 1.16.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) via shortcode. The plugin fails to verify if a user is authorized to read a gallery before rendering it. This flaw allows authors to embed and expose non-public gallery m...

CVE-2026-104684 Envira Gallery < 1.16.2 - Author+ IDOR via Shortcode

The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors...

CVE-2023-46449

CVE-2023-46449 Incorrect Access Control VIDEO POC LINK https://www.youtube.com/watch?v=H5QnsOKjs3s Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of another user and takeover the account via...

CVE-2026-61946-Easy-Appointments-IDOR

CVE-2026-61946: One Appointment ID to Somebody Else's Booking I found an unauthenticated insecure direct object reference in the WordPress Easy Appointments plugin. The public reservation endpoint accepted an id from the query string and passed the resulting data into the plugin's database replac...

CVE-2024-27630

CVE-2024–27630 Vulnerability Details Overview In Savane v3.12 and prior, a lack of validation on the fileid parameter when deleting a file from /bugs/index.php leads to an Insecure Direct Object Reference IDOR vulnerability that can cause an authenticated administrator of a group with a bug track...

CVE-2026-108641

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded...

CVE-2026-108607

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked G...