999 matches found
CVE-2026-69094
Admidio before 5.0.11 is affected by CVE-2026-69094: an insecure direct object reference in the save_temporary mode of mylist_function.php allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users’ p...
foreUP golf management platform's web API contains multiple vulnerabilities
Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check...
WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by TurboNexic in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce versions = 2.10.0...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-59539
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
EUVD-2026-49215
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
PT-2026-64934
Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...
WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Paid Member Subscriptions versions = 3.0.7...
EUVD-2026-48112
Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...
CVE-2026-65501
Unauthenticated Insecure Direct Object References IDOR in Shiptastic for WooCommerce = 5.1.0 versions...
EUVD-2026-48075
Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...
EUVD-2026-48221
Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...
EUVD-2026-48204
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
CVE-2026-47418
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...
CVE-2026-47414
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...
EUVD-2026-42199
There is an abnormal annotation within the PDF that is referenced by other objects. When the application parses the PDF, it fails to perform proper type checking, ultimately causing the application to crash...
PT-2026-56353
Name of the Vulnerable Software and Affected Versions Foxit PDF Editor/Reader affected versions not specified Description An issue exists where the application fails to perform proper type checking when parsing a PDF containing an abnormal annotation referenced by other objects. This type confusi...
WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by TristanInSec in WordPress Plugin Tutor LMS versions = 3.9.13...