4108 matches found
CVE-2026-6355
Augmentt: Cross-Tenant Access via IDOR Credits This CVE was a collaborative effort between: Raznov – GitHub: https://github.com/basraznov HelloWorld Author– GitHub: https://github.com/Penquinsecq Description A vulnerability in the web application allows unauthorized users to access and manipulate...
CVE-2026-6201-IDOR
Broken Access Control in CodeAstro Online Job Portal Allows Arbitrary Job Deletion Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: Broken Access Control IDOR CWE: CWE-639 Affected File: /jobs/job-delete.php Parameter: id GET Impact: An...
CVE-2026-35584
CVE-2026-35584 POC - CVE-2026-35584 FreeScout Description Summary The endpoint GET /thread/read/conversationid/threadid does not require authentication and does not validate whether the given threadid belongs to the given conversationid. This allows any unauthenticated attacker to: Mark any threa...
CVE-2026-30945-PoC
🗑️ CVE-2026-30945 StudioCMS IDOR — Arbitrary API Token Revocation Leading to Denial of Service NVD • Advisory • CWE-639 Overview The DELETE /studiocmsapi/dashboard/api-tokens endpoint in StudioCMS ≤ 0.3.0 allows any authenticated user with editor privileges or above to revoke API tokens belonging...
CVE-2026-1375
CVE-2026-1375: Authenticated IDOR / Broken Access Control in Tutor LMS Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit systems...
djust has broken object-level access control (IDOR)
Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...
CVE-2023-49339
CVE-2023-49339 Security Vulnerability Report: Ellucian Banner System Introduction This document outlines a critical security vulnerability found in the Ellucian Banner System, particularly in version 9.17 and earlier versions. The vulnerability has been identified in systems used by various...
CVE-2026-97269
Unauthenticated Insecure Direct Object References IDOR in WPFunnels = 3.13.1 versions...
CVE-2026-97251
Unauthenticated Insecure Direct Object References IDOR in Bus Ticket Booking with Seat Reservation = 5.9.3 versions...
CVE-2026-100517
Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...
CVE-2026-100514
Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...
CVE-2026-100517 WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...
EUVD-2026-90843
Unauthenticated Insecure Direct Object References IDOR in Photo Reviews for WooCommerce = 1.2.30 versions...
CVE-2026-100517
The Photo Reviews for WooCommerce WordPress plugin (versions
CVE-2026-100514
The WordPress REST API Log plugin affects versions
EUVD-2026-90842
Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...
CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...
CVE-2026-97269
The WPFunnels WordPress plugin (versions