CVE-2026-54256 Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to rea...

CVE-2026-81031

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middlewa...

CVE-2026-3235

The WP Data Access plugin for WordPress is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) in all versions up to and including 5.5.68 . The flaw resides in the check_app_access function, where a mismatch between the authorization check (performed against app_id) and the d...

EUVD-2026-66407

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2024-48217

CVE-2024-48217 Sismart Sicherheitslücke CVE zugewiesen: CVE-2024-48217 mitre.org nvd.nist.org tenable.com Datum: 5. September 2024 Autor: Ajriel Rizqy Maulana Software-Link: SiSMART Intelligente App zur Unterstützung des Bildungsprozesses - 7.4.0 SiSMART API Intelligente App zur Unterstützung des...

CVE-2024-37010

CVE-2024-37010 Exploit per CVE-2024-37010: accesso allo storage esterno di altri utenti e movimento laterale: https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0753/ https://owncloud.com/security-advisories/insecure-direct-object-reference-in-external-storage Introduzione Owncloud trasforma un...

CVE-2015-6668

CVE-2015-6668 Evangelos Mourikis POC für CVE-2015-6668 konvertiert für Python 3 Nutzt IDOR-Schwachstelle im Job Manager Plugin für Wordpress aus. Getestet auf Python 3.11.9 Referenzen NIST CVE WPScan Vuln DB Einrichtung und Verwendung Klonen Sie das Repository, richten Sie eine virtuelle Umgebung...

CVE-2025-12030

CVE-2025-12030: Unsichere direkte Objektreferenz im ACF to REST API WordPress Plugin Schlagwörter: CVE-2025-12030, ACF to REST API Schwachstelle, IDOR, WordPress-Sicherheit, authentifizierter Exploit, WordPress-Plugin-Schwachstelle, CWE-639, ACF-Feldänderung, Autorisierungsumgehung, WordPress CVE...

WordPress WP Data Access plugin <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access vulnerability

Unauthenticated Insecure Direct Object Reference to Data Access vulnerability discovered by type5afe in WordPress Plugin WP Data Access versions = 5.5.68...

CVE-2026-14212

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

CVE-2026-77789

CVE-2026-77789 affects the Stripe Payment Forms by WP Full Pay WordPress plugin in versions before 8.5.1 . The vulnerability is a cross-customer subscription modification via IDOR (Insecure Direct Object Reference): the plugin does not verify that a subscription belongs to the customer bound to t...

CVE-2026-77789 Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDOR

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...

CVE-2026-74930 WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR

The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its REST API routes, allowing any authenticated user, such as a subscriber, to read any other user's activity history along with their email...

CVE-2026-74930

The WordPress Project Manager plugin (versions 2.2.0–4.0.6 ) contains an IDOR flaw in one of its REST API routes: it fails to verify that the user whose activity feed is being requested is the same user making the request. As a result, any authenticated user at subscriber level or above can read ...

CVE-2026-74929 WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR

The Project Manager WordPress plugin before 4.0.7 does not restrict several of its REST API routes to the projects a user belongs to, allowing any authenticated user, such as a subscriber, to read other projects' task content and user email addresses and to modify other projects' task boards...

CVE-2026-74929

The WP Project Manager WordPress plugin (by WEDevs) prior to 4.0.7 suffers from an IDOR (Insecure Direct Object Reference) flaw in several of its REST API routes . Because these routes are not properly scoped to the projects a user belongs to, any authenticated user with at least Subscriber role ...

EUVD-2026-66268

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

CVE-2026-14212

The Amelia Pro WordPress plugin (Booking for Appointments and Events Calendar) versions before 9.8 contain an IDOR (Insecure Direct Object Reference) flaw in the Employee Panel. The plugin fails to verify that an authenticated employee owns the provider account being updated, allowing any employe...

CVE-2026-14212 Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...

CVE-2026-14212 Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR

The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee provider owns the provider account being updated, allowing any employee with an Employee Panel login to overwrite another employee's cabinet password and take over their...