CVE-2026-16568

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-78139

The Notifima WordPress plugin (also known as WooCommerce Product Stock Alert) in versions prior to 3.1.4 contains an IDOR (Insecure Direct Object Reference) flaw in one of its REST endpoints. The endpoint fails to verify that the calling user owns the subscription being modified, allowing any aut...

CVE-2026-78139 Notifima < 3.1.4 - Subscriber+ Stock Alert Unsubscription via IDOR

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product...

CVE-2026-16568 ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user e.g. a customer/subscriber to...

CVE-2026-16568

This is an IDOR (Insecure Direct Object Reference) vulnerability in The Mobile App for WooCommerce: ShopApper WordPress plugin. A REST endpoint fails to verify that the requesting user owns the customer profile being queried, allowing any authenticated Subscriber+ user to retrieve other users' pe...

CVE-2026-6201-IDOR

Controle de Acesso Quebrado no CodeAstro Online Job Portal Permite Exclusão Arbitrária de Vagas Detalhes Fornecedor: CodeAstro Produto: Online Job Portal Project in PHP MySQL Versão: 1.0 Tipo de Vulnerabilidade: Controle de Acesso Quebrado IDOR CWE: CWE-639 Arquivo Afetado: /jobs/job-delete.php...

CVE-2026-35584

CVE-2026-35584 POC - CVE-2026-35584 FreeScout Descrizione Riepilogo L'endpoint GET /thread/read/conversationid/threadid non richiede autenticazione e non verifica che il threadid fornito appartenga al conversationid indicato. Ciò consente a qualsiasi utente non autenticato di: Contrassegnare...

CVE-2025-51862

CVE-2025-51862 Description de la vulnérabilité TelegAI, une application web pour construire et discuter avec des personnages IA, est vulnérable à une référence directe d'objet non sécurisée IDOR dans son composant de chat. Un attaquant peut exploiter cet IDOR pour altérer les conversations d'autr...

CVE-2025-51859

CVE-2025-51859 Beschreibung der Schwachstelle Chaindesk, eine Webanwendung zur Erstellung von KI-Agenten, ist in seiner Chat-Komponente für Agenten anfällig für gespeichertes Cross-Site Scripting XSS. Ein Angreifer kann beliebige clientseitige Skriptausführung erreichen, indem er einen KI-Agenten...

CVE-2025-51868

CVE-2025-51868 Beschreibung der Schwachstelle Dippy ist eine beliebte Website, auf der man mit Millionen proaktiver KI-Charaktere chatten kann. Dippy ermöglicht es Benutzern, mit Charakteren auf Basis von LLM zu chatten, was in seiner Chat-Komponente anfällig für Insecure Direct Object Reference...

CVE-2025-51867

CVE-2025-51867 Beschreibung der Schwachstelle Deepfiction AI ist ein KI-Unterhaltungsunternehmen mit der Mission, personalisiertes Geschichtenerzählen zu revolutionieren. Deepfiction AI stellt eine Webanwendung bereit, um Geschichten durch Chatten mit einem LLM zu erstellen. Diese ist in ihrer...

CVE-2025-51865

CVE-2025-51865 Schwachstellenbeschreibung Ai2 ist ein gemeinnütziges KI-Forschungsinstitut mit Sitz in Seattle. Ai2 bietet eine Playground-Webanwendung zum Chatten mit ihrem LLM an, die in ihrer Chat-Komponente anfällig für Insecure Direct Object Reference IDOR ist. Ein Angreifer kann dieses IDOR...

CVE-2025-51858

CVE-2025-51858 Descrição da vulnerabilidade ChatPlayground.ai é um aplicativo web popular para comparar modelos de IA. Existe uma vulnerabilidade de Cross-Site Scripting XSS no componente de chat. Isso pode levar ao roubo de token JWT e ao sequestro remoto de contas. Além disso, o endpoint...

CVE-2024-27630

CVE-2024–27630 漏洞详情 概述 在 Savane v3.12 及更早版本中，从 /bugs/index.php 删除文件时缺少对 fileid 参数的验证，导致不安全的直接对象引用 IDOR 漏洞，这使得拥有错误跟踪器的组中的认证管理员可以任意删除任何错误跟踪器的文件附件，从而导致这些文件不可用。由于文件 ID 随每次新上传而递增，因此可以创建一个脚本，通过 fileid 迭代删除服务器上的所有文件附件。 CWE 分类： CWE-639：通过用户控制密钥绕过授权 报告者： Ally Petitt 受影响产品： Savane 受影响版本： 3.12 及更早版本 技术细节...

CVE-2026-30945-PoC

🗑️ CVE-2026-30945 StudioCMS IDOR — Revoca Arbitraria di Token API che Porta a Denial of Service NVD • Advisory • CWE-639 Panoramica L'endpoint DELETE /studiocmsapi/dashboard/api-tokens in StudioCMS ≤ 0.3.0 consente a qualsiasi utente autenticato con privilegi di editor o superiori di revocare toke...

AIDOR

AIDOR 👁️ - Rilevatore Automatico di Insecure Direct Object Reference AIDOR Rilevatore Automatico di IDOR è un'utilità Bash professionale per penetration tester autorizzati per identificare vulnerabilità di Insecure Direct Object Reference IDOR nelle applicazioni web. Rileva ID numerici, pattern di...

CVE-2023-49339

Relatório de Vulnerabilidade de Segurança CVE-2023-49339: Sistema Banner da Ellucian Introdução Este documento descreve uma vulnerabilidade de segurança crítica encontrada no Sistema Banner da Ellucian, particularmente na versão 9.17 e versões anteriores. A vulnerabilidade foi identificada em...

CVE-2026-12400-Exploit

CVE-2026-12400 — FlowForms IDOR: Unbefugte Formularänderung Authentifiziert Contributor+ Insecure Direct Object Reference zur beliebigen Formularänderung in FlowForms ≤ 1.1.1 Schwachstellenübersicht...

CVE-2025-55886

CVE-2025-55886 描述 在ARD中发现了一个不安全的直接对象引用（IDOR）漏洞。该漏洞存在于支付历史API端点的feuid参数中。已认证的攻击者可以操纵此参数，未经授权访问其他用户的支付历史。 受影响组件 root@kitploit: https://services.ard.fr/?eID=txafereloadrecords&dc=1743696277812&feuid=USERID&startTimestamp=1741017877&endTimestamp=1743782677&mobile=1&page=1&start=0&limit=100 受影响的产品代码库...

CVE-2023-6538

CVE-2023-6538 CVE-2023-6538 è un Insecure Direct Object Reference IDOR nella vulnerabilità presente nella funzionalità Configuration Backup & Restore di System Management Unit SMU di Hitachi NAS HNAS. Questa vulnerabilità interessa le versioni di SMU precedenti alla 14.8.7825.01. Sfruttamento...