223 matches found
CVE-2026-28180
Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...
EUVD-2026-53900
Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...
CVE-2026-69094
Admidio before 5.0.11 is affected by CVE-2026-69094: an insecure direct object reference in the save_temporary mode of mylist_function.php allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users’ p...
PT-2026-64934
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-65456
Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...
CVE-2026-65463
Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...
EUVD-2026-48075
Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...
CVE-2026-65456 WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...
EUVD-2026-48204
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
PT-2026-63862
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Product Slider for WooCommerce versions = 1.13.62...
CVE-2026-47418
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...
CVE-2026-47414
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...
EUVD-2026-46339
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...
EUVD-2026-43658
The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.0 via the 'savelessonnote', 'getlessonnote', and 'completelessonvideo' AJAX handlers due to missing validation on...
WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by TristanInSec in WordPress Plugin Tutor LMS versions = 3.9.13...
CVE-2026-57680
Unauthenticated Insecure Direct Object References IDOR in Kirki = 6.0.11 versions...
WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.9.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by HieuPenguinnn in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.9.0...
WordPress Simple User Avatar plugin <= 4.9 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Simple User Avatar versions = 4.9...