4851 matches found
CVE-2026-85209 IDOR in AVEZ Electronics's LMS
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...
CVE-2026-85209 IDOR in AVEZ Electronics's LMS
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...
CVE-2026-104403 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9...
WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin LearnPress versions = 4.4.9...
CVE-2026-94432
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...
CVE-2026-94432 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...
CVE-2026-94432 Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...
CVE-2026-94432: Authorization Bypass Through User-Controlled Key
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...
WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability
Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability discovered by Niv Kochan, Matan Bachar in WordPress Plugin LatePoint versions = 5.7.1...
djust has broken object-level access control (IDOR)
Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...
PYSEC-2026-4041 djust has broken object-level access control (IDOR)
Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...
CVE-2026-97269
Unauthenticated Insecure Direct Object References IDOR in WPFunnels = 3.13.1 versions...
CVE-2026-97251
Unauthenticated Insecure Direct Object References IDOR in Bus Ticket Booking with Seat Reservation = 5.9.3 versions...
CVE-2026-100517
Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...
CVE-2026-100514
Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...
CVE-2026-100517 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...
CVE-2026-100517
The Photo Reviews for WooCommerce WordPress plugin (versions
CVE-2026-100517 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...
