4898 matches found
PT-2026-95207
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logged-in user can retrieve a list of memberships for a circle they do not belong to by guessing a 62^15 complex unique identifier. This is an Insecure Direct...
PT-2026-95248
Name of the Vulnerable Software and Affected Versions Easy Appointments versions 4.0 through 4.0.2.1 Description The plugin fails to perform ownership or authorization checks on the unauthenticated appointment-reservation endpoint. This allows unauthenticated attackers to overwrite or delete...
PT-2026-95251
Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if the requesting user owns a course before returning its enrolled-student data. This allows...
PT-2026-95279
Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.69 Description An Insecure Direct Object Reference IDOR exists in the duplicate function hooked on admin init. The issue occurs because the handler verifies only the generic edit posts capability and a...
PT-2026-95283
Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.6.4 Description An Insecure Direct Object Reference IDOR exists in the LatePointAbilityDeleteBooking::execute function due to missing validation on a...
CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...
CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...
CVE-2026-18441
The LatePoint – Appointment Booking & Scheduling WordPress plugin (≤ 5.6.9) is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) via the customer[id] parameter. The root cause is missing validation on a user-controlled key in the set_customer_object function, allowing attac...
CVE-2026-54671
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...
CVE-2026-54519
AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memory.controller.js authenticates requests but listMemories, deleteMemory, and clearAgentMemory use a caller-supplied agentId or memory id...
CVE-2026-54519
AI Agent Automation (npm package backend, repo vmDeshpande/ai-agent-automation) had missing ownership checks in backend/src/controllers/memory.controller.js. The functions listMemories, deleteMemory, and clearAgentMemory accepted a caller-supplied agentId or memory _id without verifying that the ...
EUVD-2026-82575
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...
WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability
Authenticated Custom+ Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability discovered by skyv3il, Chirita Catalin-Andrei CC99IE, AmonRa, MrProperCTF in WordPress Plugin LatePoint versions = 5.6.3...
WordPress Download Manager plugin <= 3.3.68 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Disclosure vulnerability discovered by pbsec in WordPress Plugin Download Manager versions = 3.3.68...
WordPress WP Events Manager plugin < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability
Unauthenticated Payment Bypass and Booking Status Update via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Events Manager versions 2.2.5...
WordPress Five Star Restaurant Reservations plugin < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability
Unauthenticated Payment Bypass and Booking Confirmation via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Five Star Restaurant Reservations versions 2.7.23...
CVE-2026-73999
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-66575
Unauthenticated Insecure Direct Object References IDOR in King Addons for Elementor = 51.1.81 versions...