CVE-2026-112286

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve...

Danswer - Insecure Direct Object Reference

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. id: CVE-2024-9617 info: name: Danswer - Insecure Direct Object Reference author: s4e-io severity: medium...

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

CVE-2022-30190

CVE-2022-30190 Microsoft Office Word RCE Reproduction CVE-2022-30190 Vulnerability Overview MS Office docx files may contain external OLE object references as HTML files. There is an HTML scenario ms-msdt: that calls the msdt diagnostic tool, which is capable of executing arbitrary code specified...

Tiredful-API

What is Tiredful API? Tiredful API is intentionally designed broken app. The aim of this web app is to teach developers, QA or security professionals about flaws present in webservices REST API due to insecure coding practice. Who can use Tiredful API? Web developers Web Pentesters Security...

CVE-2017-11317-auto-exploit-

Vulnerabilities CVE-2017-11317 . https://www.telerik.com/support/kb/aspnet-ajax/upload-%28async%29/details/insecure-direct-object-reference...

EUVD-2026-103308

Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic that allows authenticated members to modify other users' forum topics. Attackers can replace the topicuuid parameter in their own topicsave request, reusing their CSRF token, to...

EUVD-2026-103315

phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/userId, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin or protected-target check. Delegated...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Kirki versions = 6.3.2...

CVE-2026-107762

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

EUVD-2026-103213

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-107762 Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-107762 Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

CVE-2026-107762

The Kirki WordPress plugin (versions up to and including 6.3.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The issue stems from a missing validation on a user-controlled key within the 'context' parameter , allowing unauthenticated attackers to perform context smuggling . This...

PT-2026-116475

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 3.2.0 through 4.1.8 phpMyFAQ versions 4.2.0-alpha through 4.2.0-alpha Description An insecure direct object reference exists in the 'GET /admin/api/user/data/userId' endpoint. The system returns the complete faquserdata row f...

Vedo Suite 1.2.5 Insecure Direct Object Reference

Vedo Suite version 1.2.5 contains an insecure direct object reference vulnerability that allows an authenticated low-privileged user to access other users' private data by changing user-controlled API identifiers...

jsherp-user-info-idor

jshERP /user/info IDOR — VulDB submission package This repository contains a standalone VulDB-style advisory for an authenticated insecure direct object reference in jshERP. Product: jshERP Tested commit: ad6cf886dd4e0676723060a25d361c703dc56bc0 3.6-SNAPSHOT, GitHub master HEAD on 2026-09-04...

CVE-2026-111722

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id ...

CVE-2026-111709

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...

CVE-2026-111702

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/id or the knowledgebaseId parameter of POST...