29300 matches found
PT-2026-57406
The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27 via the wcfm product archive due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
PT-2026-57388
Name of the Vulnerable Software and Affected Versions PDF Invoices & Packing Slips for WooCommerce versions prior to 5.14.1 Description An Insecure Direct Object Reference IDOR exists in the generate document shortcode function due to missing validation on a user-controlled key. Authenticated...
CVE-2026-13232
The Drupal Advanced Content Feedback (aka admin_feedback ) module, versions 0.0.0 through 2.8.0 , is vulnerable to an Incorrect Authorization issue allowing Forceful Browsing . The root cause is that the module fails to sufficiently verify authorization over a targeted feedback record when proces...
CVE-2026-13232 Advanced Content Feedback (aka admin_feedback) - Moderately critical - Access bypass / Insecure Direct Object Reference (IDOR) - SA-CONTRIB-2026-052
Incorrect Authorization vulnerability in Drupal Advanced Content Feedback aka adminfeedback allows Forceful Browsing. This issue affects Advanced Content Feedback aka adminfeedback versions: from 0.0.0 to 2.8.0...
CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...
CVE-2026-55880 OpenReplay: Cross-user IDOR in notes and dashboard widgets
OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.updatewidget an...
MINI-VCRV-V854-5MJ3
Bulletin has no description...
MINI-VJR5-CFV7-2F73
Bulletin has no description...
MINI-QPP8-CRPR-HJ9F
Bulletin has no description...
MINI-8739-QQCF-FW6R
Bulletin has no description...
MINI-V5H9-W3CP-78XQ
Bulletin has no description...
MINI-7VPJ-2C6V-V77R
Bulletin has no description...
MINI-HJ8P-PGWW-8W8C
Bulletin has no description...
MINI-4V4M-JPW2-H2QM
Bulletin has no description...
MINI-V24C-42Q7-57V4
Bulletin has no description...
MINI-J7CF-7MWR-CW39
Bulletin has no description...
MINI-W9VQ-P878-QP23
Bulletin has no description...
MINI-24R6-P886-HRV2
Bulletin has no description...