900 matches found
Tiredful-API
Tiredful APIใจใฏ๏ผ Tiredful APIใฏใๆๅณ็ใซ่ๅผฑใซ่จญ่จใใใใขใใชใฑใผใทใงใณใงใใใใฎWebใขใใชใฑใผใทใงใณใฎ็ฎ็ใฏใ้็บ่ ใQAใใปใญใฅใชใใฃๅฐ้ๅฎถใซๅฏพใใฆใๅฎๅ จใงใชใใณใผใใฃใณใฐๆ ฃ่กใซ่ตทๅ ใใWebใตใผใใน๏ผREST API๏ผใฎๆฌ ้ฅใๆใใใใจใงใใ Tiredful APIใไฝฟ็จใงใใไบบ Web้็บ่ Webใใใใฌใผใทใงใณใในใฟใผ ใปใญใฅใชใใฃๅฐ้ๅฎถ ๅญฆ็ Tiredful APIใซๅซใพใใใใฎ...
CVE-2026-35678
่ๅผฑๆง่ชฟๆปใฌใใผใ: All Eduplus Student ERP ใฎๅฎๅ จใงใชใ็ดๆฅใชใใธใงใฏใๅ็ ง IDOR ็ ็ฉถ่ : Vinay Sharma 1. ใจใฐใผใฏใใฃใใตใใชใผ ๆฌใฌใใผใใฏใEduplus Student ERP ใใฉใใใใฉใผใ ใ็นใซๅญฆ็ๅญฆ็ฟ่ ใใผใฟใซ learnerapi.pceterp.in ใซใใใฆ็นๅฎใใใ้ซๆทฑๅปๅบฆใฎใปใญใฅใชใใฃ่ๅผฑๆงใซใคใใฆ่ฉณ่ฟฐใใใใฎใงใใๆฌใขใใชใฑใผใทใงใณใฏใ่ฉฆ้จใใฉใผใ ๆๅบใจใณใใใคใณใใซๆฎ้็ใชๅฎๅ จใงใชใ็ดๆฅใชใใธใงใฏใๅ็ ง IDOR ใฎ่ๅผฑๆงใๆฑใใฆใใใ่ช่จผใใใไปปๆใฎใฆใผใถใผ ๅญฆ็...
CVE-2024-11318
CVE-2024-11318 IDOR - AbsysNet 2.3.1 ใฆใผใถใผใใคใธใฃใใญใณใฐ ๅ ่ฒฌไบ้ ใใฎใใผใซใฏใใขใใชใฑใผใทใงใณใใใฎ็นๅฎใฎ CVE-2024-11318 ใซๅฏพใใฆ่ๅผฑใงใใใใฉใใใ็นๅฎใใๆช็จใใใใใฎๆฏๆดใ็ฎ็ใจใใฆ่จญ่จใใใฆใใพใใใใใฏใใตใคใใผใปใญใฅใชใใฃใฎๅฐ้ๅฎถใ็ ็ฉถ่ ใใใใใฌใผใทใงใณใในใฟใผใใๆ็คบ็ใช่จฑๅฏใๅพใ็ฐๅขใงใปใญใฅใชใใฃใ่ฉไพกใใใใใซไฝฟ็จใใใใจใๆๅณใใฆใใพใใ ่ๅผฑๆงใ็ขบ่ชใใใๅ ดๅใงใใๆช็จใฏใขใใชใฑใผใทใงใณใพใใฏใทในใใ ใฎๆๆ่ ใใ้ฉๅใช่จฑๅฏใๅพใๅ ดๅใซใฎใฟๅฎ่กใใฆใใ ใใใ...
EUVD-2025-209816
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference IDOR in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccbwoocommercepayment AJAX...
EUVD-2026-78655
Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...
CVE-2026-62134
An Insecure Direct Object References (IDOR) vulnerability was identified in the WordPress Starter Templates plugin (versions โค 4.7.5 ). The flaw allows a contributor-level authenticated user to manipulate objects they should not have access to, resulting in a low integrity impact (CVSS 4.3, MEDIU...
CVE-2026-80434
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an insecure direct object reference...
PT-2026-89627
Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description The software concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC Persistent Volume Claim, which is a storage resource shared...
CVE-2026-86111 BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...
CVE-2026-27432 WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Rentals: from n/a before 3.16.0...
EUVD-2026-68767
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription and set replacementsubscriptionid to a subscription ID belonging to another user. The write is accepted, and later the stats logic...
PT-2026-83412
Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.5 Description An Insecure Direct Object Reference IDOR exists where the plugin fails to verify if a subscription belongs to the customer associated with the active customer-portal sessi...
PT-2026-82423
Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as created by an...
CVE-2026-3235
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...
CVE-2026-3235 WP Data Access โ No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...
CVE-2026-3235 WP Data Access โ No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access
The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...
CVE-2026-73189
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858...
WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Modal Survey versions = 2.0.2.2.3...
CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration
Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...
CVE-2026-67622
Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...