PT-2024-33109 · Mcafee · Mcafee Epo

Name of the Vulnerable Software and Affected Versions: McAfee ePO affected versions not specified Description: The issue concerns insecure direct object references, allowing a least privileged user to manipulate client tasks and client task assignments. This can lead to privilege escalation, as t...

WordPress VikBooking plugin < 1.6.8 - Insecure Direct Object References vulnerability

Insecure Direct Object References vulnerability discovered by cyc707 in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions 1.6.8...

Globitel SpeechLog Analytics 安全漏洞

Globitel SpeechLog Analytics is a speech analysis module from Globitel. A security vulnerability exists in Globitel SpeechLog Analytics version v8.1, which stems from the discovery of an insecure direct object reference IDOR contained via the userID parameter...

Hospital Management System 安全漏洞

The Hospital Management System HMS is a computer system that helps manage healthcare-related information and helps healthcare providers do their jobs effectively. A security vulnerability exists in Sourcecodester Hospital Management System version 1.0, which stems from the presence of an insecure...

WordPress Crelly Slider plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Steven Julian Patchstack Alliance in WordPress Plugin Crelly Slider versions = 1.4.5...

WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Kyle Sanchez Patchstack Alliance in WordPress Plugin Rate my Post versions = 3.4.4...

Exploit for Deserialization of Untrusted Data in Torrentpier

CVE-2024-1651 This CVE was discovered by Carlos Bello from the...

CVE-2024-32166

Webid v1.2.1 suffers from an Insecure Direct Object Reference IDOR - Broken Access Control vulnerability, allowing attackers to buy now an auction that is suspended horizontal privilege escalation...

PT-2024-24453 · Webid · Webid

Name of the Vulnerable Software and Affected Versions: Webid version 1.2.1 Description: The issue allows attackers to exploit an Insecure Direct Object Reference IDOR vulnerability, which is a type of Broken Access Control vulnerability. This enables horizontal privilege escalation, permitting...

CVE-2023-6897

The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'algwceanproductmeta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...

WordPress FileBird plugin <= 5.6.3 - Authenticated (Author+) Insecure Direct Object Reference vulnerability

Authenticated Author+ Insecure Direct Object Reference vulnerability discovered by Tim Coen in WordPress Plugin Filebird versions = 5.6.3...

Lunary 安全漏洞

lunary is a production toolkit for LLM. An insecure direct object reference vulnerability exists in lunary, which stems from an endpoint that does not validate that a supplied project ID belongs to a currently authenticated user, and can be exploited by an attacker to cause unauthorized...

CVE-2024-1289

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it possible for authenticated attackers to...

WordPress LearnPress plugin <= 4.2.6.3 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by drop in WordPress Plugin LearnPress versions = 4.2.6.3...

PT-2024-22678 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.6 Description: The issue allows an authenticated user to exploit the Insecure Direct Object Reference IDOR vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files,...

CVE-2023-6969

The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the usermeta shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level...

WordPress Plugin User Shortcodes Plus Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-12552 · Bagisto · Bagisto

Name of the Vulnerable Software and Affected Versions: Bagisto versions 1.5.0 through 1.5.1 Description: The issue allows an attacker to obtain sensitive information via the invoice ID parameter, which is an example of an Insecure Direct Object Reference IDOR. This means that an attacker can...

Webkul Software Bagisto Security Vulnerability

Webkul Software Bagisto is an open source e-commerce framework from Indian company Webkul Software. A security vulnerability exists in Webkul Software Bagisto version v.1.5.0, which stems from an insecure direct object reference IDOR issue that allows an attacker to obtain sensitive information v...

Exploit for Deserialization of Untrusted Data in Torrentpier

CVE-2024-1651 This CVE was discovered by Carlos Bello from the...