CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

EUVD-2026-94401

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to Arbitrary Customer PII Modification vulnerability discovered by owlmind in WordPress Plugin LatePoint versions = 5.6.9...

CVE-2026-104651 Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

CVE-2026-104651 Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR

The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to act on and alter orders belonging to...

CVE-2026-104651

The Yaad Sarig Payment Gateway For WC WordPress plugin, in versions before 2.2.13 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify authorization or ownership of the target order during several order payment-processing actions . This allows any authent...

PT-2026-107574

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-102157

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

CVE-2026-102157 Security Advisory 0190

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

CVE-2026-102157 Security Advisory 0190

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

EUVD-2026-93954

An insecure direct object reference IDOR vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data...

CVE-2026-102157

An insecure direct object reference (IDOR) vulnerability exists in the CloudVision CUE file-serving interface . This flaw may allow an authenticated network user to access another user's transient data under specific attack conditions. No specific exploit details or remediation steps are provided...

CVE-2026-39756

Unauthenticated Insecure Direct Object References IDOR in Wappointment = 2.7.7 versions...

CVE-2026-39756 WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Wappointment = 2.7.7 versions...

EUVD-2026-93265

Unauthenticated Insecure Direct Object References IDOR in Wappointment = 2.7.7 versions...

CVE-2026-39756 WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Wappointment = 2.7.7 versions...

CVE-2026-39756

The Wappointment plugin for WordPress (versions

CVE-2026-32576

Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2...