EUVD-2026-115239

Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairi...

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

Danswer - Insecure Direct Object Reference

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. id: CVE-2024-9617 info: name: Danswer - Insecure Direct Object Reference author: s4e-io severity: medium...

CVE-2026-119166 Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'memberID' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existin...

CVE-2026-119166

The Welcart e-Commerce plugin for WordPress (versions up to and including 2.12.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a lack of validation on the 'member[ID]' parameter, allowing unauthenticated attackers to overwrite the email address and password of ...

PT-2026-134458

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.6 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Unauthenticated attackers can overwrite the email address and...

CVE-2026-119166: uscnanbu Welcart e-Commerce: The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,…

The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 via the 'memberID' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite any existin...

CVE-2026-93399

CVE-2026-93399 — Bookly IDOR order token disclosure & booking rollback Python 3 PoC for CVE-2026-93399 in Bookly bookly-responsive-appointment-booking-tool. Description PoCbit / GitHub CVE-2026-93399 — Bookly ≤ 28.2 suffers from Insecure Direct Object Reference CWE-639 on public booking AJAX:...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover vulnerability

Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover vulnerability discovered by Wordfence Argus in WordPress Plugin Forminator versions = 1.57.3.1...

CVE-2026-97638

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

CVE-2026-97638 Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

EUVD-2026-114220

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

CVE-2026-97638

The Forminator Forms plugin for WordPress (all versions up to and including 1.57.3.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists in the previous_draft_id parameter due to a lack of validation on a user-controlled key. Unauthenticated attackers who obtain a vict...

CVE-2026-97638 Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

CVE-2026-119650

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a target uid parameter to read and...

CVE-2026-119652

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing t...

CVE-2026-119651

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete...

CVE-2026-119598

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...

EUVD-2026-114068

HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing t...

EUVD-2026-113935

Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment externalsubscriptionid parameter to disclose override scripts...