Tiredful-API

Что такое Tiredful API? Tiredful API — это намеренно созданное приложение с уязвимостями. Цель этого веб-приложения — обучить разработчиков, QA-специалистов и специалистов по безопасности недостаткам веб-сервисов REST API, возникающим из-за небезопасных практик программирования. Кто может...

CVE-2026-35678

脆弱性調査レポート: All Eduplus Student ERP の安全でない直接オブジェクト参照 IDOR 研究者: Vinay Sharma 1. エグゼクティブサマリー 本レポートは、Eduplus Student ERP プラットフォーム、特に学生学習者ポータル learnerapi.pceterp.in において特定された高深刻度のセキュリティ脆弱性について詳述するものです。本アプリケーションは、試験フォーム提出エンドポイントに普遍的な安全でない直接オブジェクト参照 IDOR の脆弱性を抱えており、認証された任意のユーザー 学生...

CVE-2024-11318

CVE-2024-11318 IDOR - Угон пользователей AbsysNet 2.3.1 ОТКАЗ ОТ ОТВЕТСТВЕННОСТИ Этот инструмент предназначен для помощи в выявлении и эксплуатации уязвимости CVE-2024-11318 в приложениях. Он предназначен для использования специалистами по кибербезопасности, исследователями и тестировщиками на...

CVE-2026-3235

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-3235 WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'checkappaccess' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to access data from...

CVE-2026-73189

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-14858...

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by luc in WordPress Plugin Modal Survey versions = 2.0.2.2.3...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622

Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-19111

CVE-2026-19111 affects Amazon Strands Agents Tools’ memory tools (mongodb_memory, elasticsearch_memory, mem0_memory) prior to 0.8.3. The issue is an insecure direct object reference that could allow remote authenticated users to access, modify, or delete memories belonging to other tenants by pro...

CVE-2026-65523

CVE-2026-65523 affects the WordPress plugin Formidable Forms Signature Online Contract Automation (versions

CVE-2026-65523

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-16070

The CVE-2026-16070 relates to the Brizy WordPress plugin (before 2.8.19). The vulnerability arises because it does not properly verify authorization when updating a template’s type meta, validating a request parameter different from the one used in the write operation. This IDOR-like flaw enables...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

CVE-2025-71400

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with...

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

CVE-2025-14073 WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...