Каталоги
В сервис интегрированы наиболее популярные публичных базы знаний:
- Сертификаты СЗИ - Государственный реестр сертифицированных средств защиты информации опубликованный Федеральной службой по техническому и экспортному контролю, может быть использован для контроля актуальности используемых СЗИ в организации.
- CWE уязвимости - общедоступная публичная база распространенных типов уязвимостей в программном и аппаратном обеспечении, которые могут иметь последствия для безопасности - Common weakness enumeration.
- CVE уязвимости - общедоступная публичная база уязвимостей Common Vulnerabilities and Exposures (CVE). Миссия программы CVE заключается в выявлении, определении и каталогизации публично раскрываемых уязвимостей в сфере кибербезопасности. Для каждой уязвимости в каталоге существует одна запись CVE. Уязвимости обнаруживаются, затем присваиваются и публикуются организациями по всему миру, которые сотрудничают с программой CVE. Партнеры публикуют записи CVE для единообразного описания уязвимостей. Специалисты в области информационных технологий и кибербезопасности используют записи CVE, чтобы убедиться, что они обсуждают одну и ту же проблему, и координировать свои усилия по определению приоритетности и устранению уязвимостей.
- БДУ ФСТЭК уязвимости - раздел Уязвимости Банка данных уязвимостей опубликованная Федеральной службой по техническому и экспортному контролю совместно с Государственным научно-исследовательским испытательным институтом проблем технической защиты информации. Одной из целей создания банка данных угроз безопасности информации является объединение специалистов в области информационной безопасности для решения задач повышения защищенности информационных систем.
- НКЦКИ уязвимости - общедоступная публичная база уязвимостей Национального координационного центра по компьютерным инцидентам (НКЦКИ), обеспечивающего координацию деятельности субъектов КИИ по обнаружению, предупреждению, ликвидации последствий компьютерных атак и реагированию на компьютерные инциденты.
- MITRE ATT&CK – Adversarial Tactics, Techniques & Common Knowledge – Тактики, техники и общеизвестные знания о злоумышленниках. Это основанная на реальных наблюдениях база знаний компании Mitre, содержащая описание тактик, приемов и методов, используемых киберпреступниками. База создана в 2013 году и регулярно обновляется, цель – составление структурированной матрицы используемых киберпреступниками приемов, чтобы упростить задачу реагирования на киберинциденты.
- БДУ ФСТЭК и Новая БДУ ФСТЭК – раздел Угрозы Банка данных угроз, опубликованный в 2015 году Федеральной службой по техническому и экспортному контролю и Государственным научно-исследовательским испытательным институтом проблем технической защиты информации, обязателен при моделировании угроз при построении систем защиты персональных данных, критической информационной инфраструктуры, государственных информационных систем.
Каталог Справка открывает раздел документации по каталогам.
Уязвимости CVE, БДУ ФСТЭК и НКЦКИ
Каталоги CVE уязвимости, БДУ ФСТЭК уязвимости и НКЦКИ уязвимости предоставляют дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Метрики:
- Найденные уязвимости – отображает количество найденных в отчетах от сканеров уязвимостей которые связаны с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей);
- Уязвимые хосты – отображает количество хостов на которых обнаружены уязвимости связанные с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей).
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор - особенностью данного фильтра является автоматический разбор текста с последующим извлечением из текста идентификаторов. Для этого необходимо вставить произвольный текст с идентификаторами в поле и добавить в фильтр через кнопку плюс;
- Табличную часть с полями для каталогов CVE и БДУ ФСТЭК:
- Идентификатор - id уязвимости в базе уязвимостей;
- Описание - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- CVSS - числовая оценка уязвимости согласно источнику, с указанием даты выявления уязвимости экспертами, оценка отображается цветом согласно оценке CVSS 0.1 – 3.9 Low Зеленый,
4.0 – 6.9 Medium Желтый, 7.0 – 8.9 High Оранжевый, 9.0 – 10.0 Critical Красный.
- Табличную часть с полями для каталогов CVE :
- Дата бюллетеня - информация о дате публикации бюллетеня содержащего уязвимости;
- Идентификатор - id уязвимости в базе уязвимостей;
- Информация - текстовое описание уязвимости;
- Вектор атаки - локальный или сетевой вектор атаки;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Наличие обновления - - флаг, данный статус отображается если база уязвимостей содержит информацию о наличии обновлений от производителя уязвимого ПО;
- Дата выявления - даты выявления уязвимости экспертами.
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
- Функционал для экспорта всех уязвимостей каталога.
- Для каталога добавляется функционал Варианты отображения:
- Бюллетени - изменяет отображение табличной части на реестр бюллетеней, отображает общее количество уязвимостей в бюллетени в поле Уязвимостей в бюллетени и статус по обнаружению в поле Обнаружено - данный статус отображается если хотя бы одна уязвимость из бюллетеня обнаружена в инфраструктуре.
- Уязвимости.
MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК
Данные из каталогов MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК могут использоваться для контекстного наполнения риска в модуле Риски.
Каждый из указанных каталогов сформирован по собственной схеме данных, которая не соответствует подходу оценки риска, используемому в сервисе. Но в основе своей указанные базы описывают все те же риски информационной безопасности, каждый под своим углом. Поэтому они добавлены в сервис и как отдельные компоненты и как основа для создания рисков, угроз или уязвимостей.
Каталоги могут использоваться в сервисе с целью:
- Облегчения процесса формирования рисков, угроз и уязвимостей;
- Обогащения информации по рискам (угрозам, уязвимостям) созданным в сервисе.
- Взгляда на компанию и оценку рисков через публичные каталоги угроз.
Сервис позволяет установить связь между объектами из каталогов и 3 типами объектов сервиса: угрозами, уязвимостями или рисками безопасности:
- Уязвимости могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK и способами реализации Новой БДУ ФСТЭК.
- Угрозы могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами и последствиями Новой БДУ ФСТЭК.
- Риски могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами, способами реализации и последствиями Новой БДУ ФСТЭК.
Такой широкий выбор возможных связей сделан потому, что объекты из каталогов угроз могут быть или угрозой или уязвимостью в контексте сервиса.
Например, УБИ.004 Угроза аппаратного сброса пароля BIOS из БДУ ФСТЭК в контексте сервиса является уязвимостью, особенностью активов типа Микропрограммное обеспечение, которая может привести к реализации угрозы Несанкционированного локального доступа к BIOS.
В большинстве случаев угрозы из БДУ ФСТЭК и техники из MITRE ATT@CK являются именно уязвимостями, использование которых ведет к реализации угроз безопасности, но бывают и исключения.
Для рисков, угроз и уязвимостей из базы Community связи с каталогами угроз уже установлены.
Связь с каталогом угроз может быть прямой или косвенной. Например, если уязвимость связана с угрозой из БДУ ФСТЭК то и все риски, в составе которых есть данная уязвимость будут автоматически связаны с угрозой из БДУ ФСТЭК.
Каталог БДУ ФСТЭК - это реестр рисков от банка данных угроз безопасности информации ФСТЭК России.
Каждая угроза содержит описание, рекомендации к каким типам активов может быть применена эта угроза, классификация по свойствам информации и вероятные источники угрозы. Дополнительно в блоке Связанные риски указаны связанные риски, а в блоке Каталоги указываются связи с записями из других каталогов.
Каталог Новая БДУ ФСТЭК от банка данных угроз безопасности информации ФСТЭК России содержит:
- матрицу Способы реализации (возникновения угроз) - каждая ячейка которых содержит описание поверхности атаки: группу способов, уровень возможностей нарушителя, возможные реализуемые угрозы, компоненты объектов воздействия, возможные меры защиты;
- Негативные последствия - перечень негативных последствий в классификации ФСТЭК в виде кода и описания;
- Угрозы - реестр угроз с описанием, каждая угроза содержит возможные объекты воздействия и возможные способы реализации угроз;
- Объекты - перечень объектов последствий с описанием и компонентами которые могут входить в состав объекта;
- Компоненты - перечень компонентов объектов воздействия с указанием объектов воздействия на которых они могут располагаться;
- Нарушители - уровни возможностей нарушителей классифицированные по возможностям и компетенции;
- Меры защиты - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя.
Каталог MITRE ATT&CK содержит:
- Матрица - содержит тактики и техники злоумышленника, позволяет на основании тактики или техники создать риск или уязвимость, в матрице указаны связи с рисками в базе Community и с рисками в базе команды;
- Тактики - направления действия нарушителя на том или ином этапе cyberkillchane;
- Техники - конкретные действия нарушителя для достижения цели на конкретном шаге cyberkillchane;
- Контрмеры - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя;
- Преступные группы - описание APT группировок и их особенности и модель поведения;
- Инструменты - ПО используемое нарушителями для вредоносного воздействия.
Матрицы могут использоваться для построения тепловой карты рисков наложенных на матрицы угроз и уязвимостей.
Уязвимости CWE
Каталог CWE уязвимости предоставляет дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.
Интерфейс каталогов идентичен и содержит следующие блоки:
- Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор;
- Табличную часть с полями:
- Идентификатор - id уязвимости в базе уязвимостей;
- Имя - текстовое описание уязвимости;
- Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
Сертификаты СЗИ
Каталог Сертификаты СЗИ может быть использован в модуле Активы как источник информации для поля Номер сертификата СЗИ. В модуле активов есть возможность вести реестр СЗИ используемых в организации, в свою очередь каталог сертификатов СЗИ позволяет связать актив с каталогом через поле актива Номер сертификата СЗИ.
Каталог Сертификаты СЗИ содержит реестр с информацией о номере сертификата, сроке действия сертификата и сроке поддержки СЗИ. Кроме реестра каталог содержит следующие метрики:
- Имеющиеся СЗИ - отображает количество активов у которых заполнено поле Номер сертификата СЗИ;
- Скоро будут просрочены - отображает количество активов у которых срок действия сертификата меньше 90 календарных дней;
- Просроченные сертификаты - отображает количество активов у которых срок действия сертификата уже истек;
- Истекшая поддержка - отображает количество активов у которых срок действия сертификата уже истек.
Каждая метрика ведёт в реестр активов и выводит список СЗИ, отфильтрованный по соответствующим параметрам.
Нажав на просмотр сертификата, мы увидим карточку сертификата, сервис хранит информацию о следующих данных:
- Номер сертификата;
- Дата внесения в реестр;
- Срок действия сертификата;
- Срок окончания тех. поддержки;
- Наименование средства (шифр);
- Схема сертификации;
- Испытательная лаборатория;
- Орган по сертификации;
- Заявитель;
- Наименования документов соответствия;
- Реквизиты заявителя.
Реестр обновляется автоматически один раз в месяц.
Куда я попал?
CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
| Тип уязвимости: | Не зависит от других уязвимостей |
| Вероятность эксплойта: |
High
|
Идентификаторы ФСТЭК уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| BDU:2015-11945 | Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю читать данные произвольных календарей |
| BDU:2019-01142 | Уязвимость пакета для настройки виртуальной машины cloud-init операционных систем семейства Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2020-00117 | Уязвимость программного средства McAfee Client Proxy, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обходить сканирование веб-трафика и получать доступ к заблокированным сайтам |
| BDU:2020-01954 | Уязвимость функции local_graph_id системы мониторинга сервера Cacti, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к конфиденциальным данным |
| BDU:2020-05534 | Уязвимость компонента xAPI микропрограммного обеспечения устройства управления конференц-связью Cisco TelePresence Collaboration Endpoint (CE) и операционной системы Cisco RoomOS, позволяющая нарушителю выполнить произвольный код |
| BDU:2021-03179 | Уязвимость универсальной системы мониторинга Zabbix, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти страницу входа и получить доступ к странице панели инструментов |
| BDU:2021-04525 | Уязвимость системы аутентификации для веб-приложений LemonLDAP::NG, связанная с ошибкой обработки ключей авторизации, позволяющая нарушителю проводить спуфинг-атаки |
| BDU:2022-01309 | Уязвимость службы Key Storage Provider (KSP) операционной системы Microsoft Windows, позволяющая нарушителю обойти процесс аутентификации |
| BDU:2022-04072 | Уязвимость программного средства создания веб-служб go-restful, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая наруштителю повысить свои привилегии |
| BDU:2023-02460 | Уязвимость микропрограммного обеспечения контроллеров Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), Nexx Smart Alarm (NXAL-100), связанная с обходом авторизации посредством использования ключа, контролируемого пользова... |
| BDU:2023-02461 | Уязвимость микропрограммного обеспечения контроллеров Nexx Garage Door Controller (NXG-100B, NXG-200), Nexx Smart Plug (NXPG-100W), Nexx Smart Alarm (NXAL-100), связанная с обходом авторизации посредством использования ключа, контролируемого пользова... |
| BDU:2023-02620 | Уязвимость платформы автоматизации NGINX Instance Manager, диспетчера подключений API NGINX API Connectivity Manager и платформы мониторинга и управления безопасностью NGINX Security Monitoring, связанная с обходом авторизации посредством использован... |
| BDU:2023-05478 | Уязвимость инструмента проверки кода Crucible, инструмента поиска и сравнения кода Fisheye , связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой инфор... |
| BDU:2023-06062 | Уязвимость компонента graph_xport.php программного средства мониторинга сети Cacti, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06462 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 15, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06463 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 15, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-06699 | Уязвимость программного средства для централизованного управления устройствами Fortinet FortiManager, межсетевого экрана FortiAnalyzer, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить до... |
| BDU:2023-06795 | Уязвимость программных платформ для разработки и управления онлайн магазинами Magento Open Source и Adobe Commerce, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю повысить свои привилегии |
| BDU:2023-06799 | Уязвимость функции аутентификации SASL Quorum Peer централизованной службы для поддержки информации о конфигурации, именования, обеспечения распределенной синхронизации и предоставления групповых служб Apache ZooKeeper, позволяющая нарушителю обойти... |
| BDU:2023-07494 | Уязвимость программного обеспечения мониторинга банкоматов ScrutisWeb, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-07999 | Уязвимость плагинов EventOn Lite и EventON системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2023-08301 | Уязвимость программного обеспечения автоматизации службы поддержки и контроля аппаратного и программного обеспечения SysAid, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получи... |
| BDU:2023-09003 | Уязвимость микропрограммного обеспечения телетрансляторов EuroTel ETL3100 и EuroTel ETL3100RT, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти ограничения безопасности, пол... |
| BDU:2024-00276 | Уязвимость процесса промежуточной установки микропрограммного обеспечения коммуникационного шлюза SIMATIC CN 4100, позволяющая нарушителю войти в систему и получить полный контроль над приложением |
| BDU:2024-01987 | Уязвимость компонента SSL-VPN операционных систем FortiOS и прокси-сервера для защиты от интернет-атак FortiProxy, позволяющая нарушителю получить несанкционированный доступ к веб-странице другого пользователя |
| BDU:2024-02400 | Уязвимость операционной системы FortiOS, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации |
| BDU:2024-02546 | Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server, связанная с обходом авторизации, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-03194 | Уязвимость службы secondscreen.gateway операционной системы LG WebOS для телевизоров LG, позволяющая нарушителю создать привилегированную учетную запись пользователя |
| BDU:2024-03857 | Уязвимость программного средства корпоративной телефонии FortiVoice связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть конфигурационные SIP-файлы |
| BDU:2024-04116 | Уязвимость веб-инструмента представления данных Grafana, связанная с обходом авторизации, позволяющая нарушителю обойти процесс авторизации и удалить моментальный снимок |
| BDU:2024-04604 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2024-05341 | Уязвимость программной платформы интеграции данных IBM InfoSphere Information Server, связанная с ошибкой обработки ключей авторизации, контролируемых пользователем, позволяющая нарушителю раскрыть защищаемую информацию или изменить произвольные данн... |
| BDU:2024-06159 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с ошибкой обработки токенов LFS, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и записывать произвольные файлы |
| BDU:2024-06229 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-07659 | Уязвимость компонента Group Member Handler программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2024-07780 | Уязвимость программной платформы создания веб-приложений Next.js, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2024-08483 | Уязвимость операционной системы Junos OS Evolved, связанная с обходом авторизации посредством использования ключа, позволяющая нарушителю обойти существующие ограничения безопасности, войти в систему и получить полный контроль над устройством |
| BDU:2024-08756 | Уязвимость программного обеспечения защиты данных Acronis Cyber Protect 16, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2024-08968 | Уязвимость микропрограммного обеспечения роутеров TOTOLINK LR350, связанная с недостатками процедуры авторизации, позволяющая нарушителю обойти ограничения безопасности |
| BDU:2024-09384 | Уязвимость платформы централизованного управления промышленными периферийными приложениями и устройствами Siemens Industrial Edge Management (IEM), связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позвол... |
| BDU:2024-10391 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю взаимодействовать с ресурсами других организаций |
| BDU:2024-10862 | Уязвимость компонента cgi-bin/ocap/ библиотечной системы AbsysNet, позволяющая нарушителю реализовать атаку методом "грубой силы" (brute force) |
| BDU:2024-11319 | Уязвимость пакета клиентской и серверной реализации протокола SSHv2 asyncssh интерпретатора языка программирования Python, позволяющая нарушителю проводить атаки типа "человек по середине" |
| BDU:2024-11391 | Уязвимость платформы для мониторинга, управления и улучшения приложений LLM Lunary, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность и конфиденциальн... |
| BDU:2024-11393 | Уязвимость функции "Evaluations" платформы для мониторинга, управления и улучшения приложений LLM Lunary, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2024-11482 | Уязвимость службы Streaming Service медиасервера Synology Media Server, позволяющая нарушителю читать произвольные файлы |
| BDU:2024-11512 | Уязвимость программного средства для централизованного управления устройствами Fortinet FortiManager, межсетевого экрана FortiAnalyzer, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая наруши... |
| BDU:2025-00548 | Уязвимость микропрограммного обеспечения многоконтурного измерителя электрического напряжения PowerLogic HDPM6000, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю повысить свои пр... |
| BDU:2025-00581 | Уязвимость инструментов для автоматизации бизнес-процессов в системе SAP SAP Business Workflow и SAP Flexible Workflow, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить не... |
| BDU:2025-01981 | Уязвимость веб-инструмента представления данных Grafana, связанная с обходом авторизации с помощью ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-02019 | Уязвимость плагина Meetup системы управления содержимым сайта WordPress, связанная сбходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-02550 | Уязвимость панели приложений в реальном времени управления содержимым базы данных SQL Directus, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить доступ к учётной записи по... |
| BDU:2025-02561 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab Enterprise Edition, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-02938 | Уязвимость платформы автоматизации процессов электронного документооборота Documino, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2025-03630 | Уязвимость компонента Manage Bank Statements программной платформы SAP S/4HANA, позволяющая нарушителю оказать влияние на целостность защищаемой информации |
| BDU:2025-03631 | Уязвимость платформы проектирования бизнес-приложений SAP Fiori, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю обойти существующие ограничения безопасности |
| BDU:2025-03853 | Уязвимость компонента Sherpa Orchestrator платформы для автоматизации процессов Sherpa RPA, позволяющая нарушителю повысить свои привилегии |
| BDU:2025-04613 | Уязвимость системы автоматизации рекрутинговых процессов E-Staff, связанная с ошибками фильтрации данных при получении информации об объекте, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05103 | Уязвимость виртуальной обучающей среды Moodle, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05106 | Уязвимость компонента RSS Block виртуальной обучающей среды Moodle, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-05111 | Уязвимость компонента Multi-Factor Authentication виртуальной обучающей среды Moodle, позволяющая нарушителю вызвать отказ в обслуживании |
| BDU:2025-05996 | Уязвимость расширения femanager системы управления контентом TYPO3, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06007 | Уязвимость расширения Front End User Registration (sr_feuser_register) системы управления контентом TYPO3, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-06008 | Уязвимость расширения Download manager (reint_downloadmanager) системы управления контентом TYPO3, позволяющая нарушителю загружать произвольные файлы |
| BDU:2025-06734 | Уязвимость API-интерфейса программного средства для создания отчетов Cisco Unified Intelligence Center и программного средства для управления контакт-центрами Unified Contact Center Enterprise (Cisco Unified CCX), позволяющая нарушителю повысить свои... |
| BDU:2025-06822 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09771 | Уязвимость команды set-initial-sql аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09793 | Уязвимость команды validate-initial-sql аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-09794 | Уязвимость интерфейса Tab-Doc API аналитической платформы Tableau Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-10193 | Уязвимость cистемы управления предприятием EvaProject (Carbon ERP), связанная с использованием небезопасной прямой ссылкой на объект (IDOR), позволяющая нарушителю получить доступ к защищаемой информации |
| BDU:2025-10638 | Уязвимость веб-панели управления многофункционального устройства (МФУ) Катюша М348, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-10982 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab EE/CE, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к данным пользоват... |
| BDU:2025-11316 | Уязвимость сценария ExportSettings.sh (/cgi-bin/ExportSettings.sh) микропрограммного обеспечения роутеров TOTOLINK EX200, позволяющая нарушителю обойти ограничения безопасности и получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12643 | Уязвимость системы управления "Ассистент", связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-12658 | Уязвимость интерфейса администрирования инструмента аналитики и управления безопасностью Fortinet FortiPortal, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-13145 | Уязвимость системы заявок, инцидентов и инвентаризации компьютерного оборудования GLPI, связанная с обходом авторизации посредством ключа, позволяющая нарушителю получить несанкционированный доступ на изменение защищаемой информации |
| BDU:2025-13638 | Уязвимость функции service_finder_switch_back() плагина Service Finder Bookings системы управления содержимым сайта WordPress, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15285 | Уязвимость компонента GetPasswordExpirationDate интерфейса прикладного программирования Exchange Web Services, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-15862 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2025-16374 | Уязвимость программного средства управления проектами и задачами JetBrains YouTrack, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2025-16491 | Уязвимость программного обеспечения для управления процессами подачи заявок Bidding Solutions, связанная с ошибкой обработки токенов LFS, позволяющая нарушителю получить несанкционированный доступ к учетным записям пользователям |
| BDU:2026-00759 | Уязвимость промышленных систем удаленного доступа mymbCONNECT24 и mbCONNECT24, VPN-портала myREX24 и виртуального сервера myREX24.virtual, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нар... |
| BDU:2026-00971 | Уязвимость механизма резервирования конфигурационных данных платформы виртуализации zVirt, позволяющая нарушителю получить несанкционированный доступ к конфигурационным данным |
| BDU:2026-00987 | Уязвимость программной платформы комплексного сетевого управления D-Link D-View, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить полный контроль над учетной записью и системой |
| BDU:2026-01945 | Уязвимость конечной точки /api-selfportal/get-info-token-properties программного комплекса Secure Authentication Server, позволяющая нарушителю провести атаку методом перебора и получить несанкционированный доступ к токенам пользователей |
| BDU:2026-03382 | Уязвимость облачного программного обеспечения для создания и использования хранилища данных Nextcloud Server и Nextcloud Enterprise Server, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказа... |
| BDU:2026-03580 | Уязвимость приложения Nextcloud calendar облачного программного обеспечения для создания и использования хранилища данных Nextcloud, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-04702 | Уязвимость пользовательского интерфейса Nginx UI сервера nginx, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой и... |
| BDU:2026-05092 | Уязвимость системы для ведения медицинской документации OpenEMR, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на конфиденциальность защищаемой информации |
| BDU:2026-05149 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-05296 | Уязвимость платформы для обмена файлами Flare, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю оказать влияние на конфиденциальность защищаемой информации |
| BDU:2026-05297 | Уязвимость платформы для обмена файлами Flare, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-06413 | Уязвимость модуля отображения Blink браузера Google Chrome, позволяющая нарушителю выполнить подмену пользовательского интерфейса |
| BDU:2026-06982 | Уязвимость платформы для автоматизации рабочих процессов N8n, связанная с обходом авторизации с помощью управляемого пользователем ключа, позволяющая нарушителю раскрыть защищаемую информацию |
| BDU:2026-07008 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2026-07013 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07015 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07016 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаем... |
| BDU:2026-07021 | Уязвимость программной платформы на базе git для совместной работы над кодом GitLab, связанная с обходом авторизации посредством использования ключа, контролируемого пользователем, позволяющая нарушителю оказать воздействие на целостность защищаемой... |
| BDU:2026-07132 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07138 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователемI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07139 | Уязвимость функции has_access_to_file() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07141 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07142 | Уязвимость функции _validate_collection_access() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07451 | Уязвимость службы управления доступом Azure Privileged Identity Management (PIM) пакета для обеспечения совместимости Microsoft Azure Entra ID, позволяющая нарушителю повысить свои привилегии |
| BDU:2026-07456 | Уязвимость функции update_message_by_id() веб-интерфейса на базе искуственного интеллекта Open WebUI, позволяющая нарушителю получить доступ на чтение, изменение или удаление данных |
| BDU:2026-07457 | Уязвимость веб-интерфейса на базе искуственного интеллекта Open WebUI, связанная с обходом авторизации посредством ключа, контролируемого пользователем, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации |
| BDU:2026-07488 | Уязвимость механизма авторизации исполнителей рабочих процессов искусственного интеллекта Duo AI workflow runners программной платформы на базе git для совместной работы над кодом GitLab, позволяющая нарушителю оказать воздействие на конфиденциальнос... |
Идентификаторы CVE уязвимостей
Идентификатор, базы данных общеизвестных уязвимостей информационной безопасности
| Идентификатор | Описание |
|---|---|
| CVE-2017-0882 | Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was i... |
| CVE-2017-0920 | GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in... |
| CVE-2017-0922 | Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsControlle... |
| CVE-2017-0936 | Nextcloud Server before 11.0.7 and 12.0.5 suffers from an Authorization Bypass Through User-Controlled Key vulnerability. A m... |
| CVE-2017-3183 | Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authentica... |
| CVE-2019-15581 | An IDOR exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) that allowe... |
| CVE-2019-15582 | An IDOR was discovered in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE) tha... |
| CVE-2019-5466 | An IDOR was discovered in GitLab CE/EE 11.5 and later that allowed new merge requests endpoint to disclose label names. |
| CVE-2019-5469 | An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to... |
| CVE-2020-16240 | GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account... |
| CVE-2020-26068 | Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability |
| CVE-2020-8154 | An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of ot... |
| CVE-2020-8235 | Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all at... |
| CVE-2020-8297 | Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a d... |
| CVE-2021-21012 | Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure |
| CVE-2021-21022 | Magento Commerce Incorrect permissions Could Lead To Unauthorized Access |
| CVE-2021-21324 | Insecure Direct Object Reference (IDOR) on "Solutions" |
| CVE-2021-22951 | Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior... |
| CVE-2021-22967 | In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to... |
| CVE-2021-24374 | Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak |
| CVE-2021-24473 | User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR |
| CVE-2021-24562 | LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR |
| CVE-2021-24655 | WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise |
| CVE-2021-24739 | Logo Carousel < 3.4.2 - Unauthorised Private Post Access |
| CVE-2021-24800 | DW Question & Answer Pro <= 1.3.4 - Arbitrary Comment Edition via IDOR |
| CVE-2021-24840 | Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure |
| CVE-2021-24892 | Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR |
| CVE-2021-25096 | IP2Location Country Blocker < 2.26.5 - Ban Bypass |
| CVE-2021-32654 | Attacker can obtain write access to any federated share/public link |
| CVE-2021-32744 | Unauthenticated attacker could gain access to currently open files |
| CVE-2021-36329 | Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious u... |
| CVE-2021-36801 | Akaunting Authentication Bypass in Company Selection |
| CVE-2021-37184 | A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker could ch... |
| CVE-2021-37628 | File Drop can be bypassed using Richdocuments app in nextcloud |
| CVE-2021-37630 | Secret Circle can be joined without approval in Nextcloud Circles |
| CVE-2021-37631 | Circle can be accessed by non-Circle members in Nextcloud Deck |
| CVE-2021-3852 | Authorization Bypass Through User-Controlled Key in weseek/growi |
| CVE-2021-39225 | Missing permission check on Deck API |
| CVE-2021-3964 | Authorization Bypass Through User-Controlled Key in elgg/elgg |
| CVE-2021-40355 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.... |
| CVE-2021-41111 | Authorization Bypass Through User-Controlled Key in Rundeck |
| CVE-2021-41129 | Authentication bypass in Pterodactyl |
| CVE-2021-4142 | The Candlepin component of Red Hat Satellite was affected by an improper authentication flaw. Few factors could allow an atta... |
| CVE-2021-4226 | RSFirewall < 1.1.25 - IP Block Bypass |
| CVE-2021-43820 | Permissions check bypass in Seafile |
| CVE-2021-44160 | Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key |
| CVE-2022-0266 | Authorization Bypass Through User-Controlled Key in livehelperchat/livehelperchat |
| CVE-2022-0442 | UsersWP < 1.2.3.1 - Subscriber+ User Avatar Override |
| CVE-2022-0512 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0613 | Authorization Bypass Through User-Controlled Key in medialize/uri.js |
| CVE-2022-0624 | Authorization Bypass Through User-Controlled Key in ionicabizau/parse-path |
| CVE-2022-0639 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0686 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-0691 | Authorization Bypass Through User-Controlled Key in unshiftio/url-parse |
| CVE-2022-1165 | Blackhole for Bad Bots < 3.3.2 - Arbitrary IP Address Blocking via IP Spoofing |
| CVE-2022-1425 | WPQA < 5.2 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-1579 | Login Block IPs <= 1.0.0 - IP Spoofing Bypass |
| CVE-2022-1580 | Site Offline < 1.5.3 - Access Bypass |
| CVE-2022-1581 | WP-Polls < 2.76.0 - IP Validation Bypass |
| CVE-2022-1600 | YOP Poll < 6.4.3 - IP Spoofing |
| CVE-2022-1613 | Restricted Site Access < 7.3.2 - Access Bypass via IP Spoofing |
| CVE-2022-1614 | WP-Email < 2.69.0 - Anti-Spam Protection Bypass via IP Spoofing |
| CVE-2022-1810 | Authorization Bypass Through User-Controlled Key in publify/publify |
| CVE-2022-1996 | Authorization Bypass Through User-Controlled Key in emicklei/go-restful |
| CVE-2022-2034 | Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API |
| CVE-2022-2080 | Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR |
| CVE-2022-2198 | WPQA < 5.7 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-23061 | Shopizer - IDOR delete superadmin |
| CVE-2022-2312 | Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF |
| CVE-2022-2367 | WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass |
| CVE-2022-2535 | SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure |
| CVE-2022-2730 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-2808 | IDOR in Prens Student Information System |
| CVE-2022-2824 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-2877 | Titan Anti-spam & Security < 7.3.1 - Protection Bypass due to IP Spoofing |
| CVE-2022-2913 | Login No Captcha reCAPTCHA < 1.7 - IP Check Bypass |
| CVE-2022-29159 | Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck |
| CVE-2022-31027 | Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator |
| CVE-2022-3282 | Drag and Drop Multiple File Upload < 1.3.6.5 - File Upload Size Limit Bypass |
| CVE-2022-3343 | WPQA < 5.9.3 - Missing validation lead to functionality abuse |
| CVE-2022-33944 | ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key |
| CVE-2022-34150 | ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key |
| CVE-2022-3459 | WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding |
| CVE-2022-3511 | Awesome Support < 6.1.2 - Subscriber+ Arbitrary Exported Tickets Download |
| CVE-2022-3589 | Miele: Vulnerability in cloud service used by appWash |
| CVE-2022-3846 | Workreap - Freelance Marketplace and Directory < 2.6.3 - Subscriber+ Private Message Disclosure via IDOR |
| CVE-2022-3891 | WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access |
| CVE-2022-39018 | Broken access controls on PDFtron data in M-Files Hubshare |
| CVE-2022-3930 | Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR |
| CVE-2022-4097 | All In One WP Security & Firewall < 5.0.8 - IP Spoofing |
| CVE-2022-4239 | Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDOR |
| CVE-2022-4340 | BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_id |
| CVE-2022-43450 | WordPress Stream Plugin <= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2022-4417 | WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API |
| CVE-2022-4505 | Authorization Bypass Through User-Controlled Key in openemr/openemr |
| CVE-2022-46179 | LiuOS vulnerable to Authorization Bypass through User-Controlled Key |
| CVE-2022-4686 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4794 | AAWP < 3.12.3 - Unsafe URL Handling |
| CVE-2022-4798 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4799 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4802 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4803 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4806 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4811 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2022-4812 | Authorization Bypass Through User-Controlled Key in usememos/memos |
| CVE-2023-0453 | WP Private Message < 1.0.6 - Private Message Disclosure via IDOR |
| CVE-2023-0749 | Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-0772 | Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-0865 | WooCommerce Multiple Customer Addresses & Shipping < 21.7 - Arbitrary Address Creation/Deletion/Access/Update via IDOR |
| CVE-2023-0882 | Authorization Bypass Through User-Controlled Key on Single Connect |
| CVE-2023-0985 | Helmholz and MB Connect Line: Account takeover via password reset in multiple products |
| CVE-2023-1125 | Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR |
| CVE-2023-1129 | WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR |
| CVE-2023-1462 | IDOR in Digikent |
| CVE-2023-1463 | Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass |
| CVE-2023-1911 | Blocksy Companion < 1.8.82 - Subscriber+ Draft Post Access |
| CVE-2023-2065 | IDOR in Armoli Technology's Cargo Tracking System |
| CVE-2023-2190 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2023-22471 | Nextcloud Deck vulnerable to authorization bypass |
| CVE-2023-2260 | Authorization Bypass Through User-Controlled Key in alfio-event/alf.io |
| CVE-2023-23679 | WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.7 is vulnerable to Insecure Direct Object References (... |
| CVE-2023-24834 | WisdomGarden Tronclass ilearn - Broken Access Control |
| CVE-2023-24842 | HGiga MailSherlock - Broken Access Control |
| CVE-2023-25160 | IDOR Vulnerability in Nextcloud Mail |
| CVE-2023-2544 | Authorization Bypass on UPV PEIX |
| CVE-2023-26428 | Attackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other users within the same context.... |
| CVE-2023-2702 | IDOR in Finex Media's Competition Management System |
| CVE-2023-2713 | IDOR vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform. |
| CVE-2023-2751 | Upload Resume <= 1.2.0 - Captcha Bypass |
| CVE-2023-28109 | Play With Docker vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2023-2844 | Authorization Bypass Through User-Controlled Key in cloudexplorer-dev/cloudexplorer-lite |
| CVE-2023-28656 | NGINX Management Suite vulnerability |
| CVE-2023-2883 | IDOR in CBOT's Chatbot |
| CVE-2023-2958 | IDOR in ATS Pro |
| CVE-2023-2978 | Abstrium Pydio Cells Change Subscription authorization |
| CVE-2023-3048 | IDOR in TMT's Lockcell |
| CVE-2023-30550 | IDOR vulnerability exists in metersphere |
| CVE-2023-30956 | IDOR in Foundry Comments allows retrieval of attachments |
| CVE-2023-30960 | Insecure Direct Object Reference (IDOR) in Foundry job-tracker |
| CVE-2023-31182 | EasyTor Applications – Authorization Bypass |
| CVE-2023-3133 | Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API |
| CVE-2023-32078 | Netmaker IDOR Vulnerability Allows User to Update Other User's Password |
| CVE-2023-3219 | EventON < 2.1.2 - Unauthenticated Post Access via IDOR |
| CVE-2023-32310 | DataEase API interface has IDOR vulnerability |
| CVE-2023-32669 | Authorization Bypass on BuddyBoss |
| CVE-2023-32747 | WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-32799 | WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.3 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3285 | A BOLA vulnerability in POST /appointments in EasyAppointments < 1.5.0 |
| CVE-2023-3286 | A BOLA vulnerability in POST /secretaries in EasyAppointments < 1.5.0 |
| CVE-2023-3287 | A BOLA vulnerability in POST /admins in EasyAppointments < 1.5.0 |
| CVE-2023-3288 | A BOLA vulnerability in POST /providers in EasyAppointments < 1.5.0 |
| CVE-2023-3289 | A BOLA vulnerability in POST /services in EasyAppointments < 1.5.0 |
| CVE-2023-3290 | A BOLA vulnerability in POST /customers in EasyAppointments < 1.5.0 |
| CVE-2023-34000 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.4.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35876 | WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35914 | WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-35916 | WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3601 | Simple Author Box < 2.52 - Contributor+ Arbitrary User Information Disclosure via IDOR |
| CVE-2023-36483 | MAS (a Carrier brand) MASmobile Classic Authorization Bypass |
| CVE-2023-36520 | WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-3700 | Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments |
| CVE-2023-3706 | ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure |
| CVE-2023-3707 | ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure |
| CVE-2023-37242 | Vulnerability of commands from the modem being intercepted in the atcmdserver module. Attackers may exploit this vulnerabilit... |
| CVE-2023-37871 | WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-38047 | A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} in EasyAppointments < 1.5.0. |
| CVE-2023-38048 | A BOLA vulnerability in GET, PUT, DELETE /providers/{providerId} in EasyAppointments < 1.5.0 |
| CVE-2023-38049 | A BOLA vulnerability in GET, PUT, DELETE /appointments/{appointmentId} in EasyAppointments < 1.5.0 |
| CVE-2023-38050 | A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} in EasyAppointments < 1.5.0 |
| CVE-2023-38051 | A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} in EasyAppointments < 1.5.0 |
| CVE-2023-38052 | A BOLA vulnerability in GET, PUT, DELETE /admins/{adminId} in EasyAppointments < 1.5.0 |
| CVE-2023-38053 | A BOLA vulnerability in GET, PUT, DELETE /settings/{settingName} in EasyAppointments < 1.5.0 |
| CVE-2023-38054 | A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} in EasyAppointments < 1.5.0 |
| CVE-2023-38055 | A BOLA vulnerability in GET, PUT, DELETE /services/{serviceId} in EasyAppointments < 1.5.0 |
| CVE-2023-38201 | Keylime: challenge-response protocol bypass during agent registration |
| CVE-2023-38513 | WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-4023 | All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR |
| CVE-2023-4036 | Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post Access |
| CVE-2023-40720 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiVoiceEntreprise version 7.0.0 through 7.0... |
| CVE-2023-4099 | Multiple vulnerabilities in IDM Sistemas QSige |
| CVE-2023-4101 | Multiple vulnerabilities in IDM Sistemas QSige |
| CVE-2023-41368 | Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps) |
| CVE-2023-41796 | WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-42455 | Wazuh vulnerable to user privilege escalation |
| CVE-2023-43668 | Apache InLong: Jdbc Connection Security Bypass in InLong |
| CVE-2023-44154 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis... |
| CVE-2023-44205 | Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 15... |
| CVE-2023-44206 | Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: Acronis... |
| CVE-2023-44249 | An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and before... |
| CVE-2023-44254 | An authorization bypass through user-controlled key [CWE-639] vulnerability in FortiAnalyzer version 7.4.1 and before 7.2.5 a... |
| CVE-2023-44981 | Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication |
| CVE-2023-45808 | iTop missing silo check on extkey in console and portal |
| CVE-2023-4587 | Insecure direct object reference in ZKTeco ZEM800 |
| CVE-2023-46311 | WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-46646 | Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository name... |
| CVE-2023-47191 | WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-47543 | An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0... |
| CVE-2023-48304 | Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user |
| CVE-2023-4836 | WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR |
| CVE-2023-48783 | An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, ve... |
| CVE-2023-49251 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of... |
| CVE-2023-4934 | IDOR in Usta AYBS |
| CVE-2023-49765 | WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-49812 | WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-50267 | MeterSphere horizontal privilege escalation vulnerability of resources in project scope. |
| CVE-2023-51502 | WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-51503 | WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2023-5922 | Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read |
| CVE-2023-6144 | Dev Blog v1.0 - ATO |
| CVE-2023-6317 | PIN/prompt bypass on the secondscreen.gateway service allows access to the SSAP API without user interaction |
| CVE-2023-6341 | Catalis CM360 allows authentication bypass |
| CVE-2023-6384 | WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDOR |
| CVE-2023-6515 | IDOR in Mia Technology's Mia-Med |
| CVE-2023-6523 | IDOR in ExtremePacs's Extreme XDS |
| CVE-2023-6724 | IDOR in Simgesel Software's Hearing Tracking System (Barosel) |
| CVE-2023-6824 | WP Customer Area < 8.2.1 - Subscriber+ Account Address Leak |
| CVE-2023-6929 | Authorization Bypass Through User-Controlled Key in EuroTel ETL3100 |
| CVE-2023-7049 | Custom Field For WP Job Manager <= 1.2 - Insecure Direct Object Reference to Sensitive Information Exposure via Shortcode |
| CVE-2023-7198 | WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private Notes |
| CVE-2023-7199 | Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post Disclosure |
| CVE-2023-7239 | wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR |
| CVE-2023-7252 | Tickera < 3.5.2.5 - Ticket leakage through IDOR |
| CVE-2023-7286 | ACF Quick Edit Fields <= 3.2.2 - Authenticated (Contributor+) Insecure Direct Object Reference |
| CVE-2024-0264 | SourceCodester Clinic Queuing System LoginRegistration.php authorization |
| CVE-2024-0421 | MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure |
| CVE-2024-0580 | Omission of key-controlled authorization in Qsige |
| CVE-2024-10075 | Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution |
| CVE-2024-10098 | ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access |
| CVE-2024-10121 | wfh45678 Radar Interface authorization |
| CVE-2024-10174 | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure D... |
| CVE-2024-10215 | WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change |
| CVE-2024-10366 | IDOR in delete attachments in danny-avila/librechat |
| CVE-2024-10439 | Sunnet eHRD CTMS - Insecure Direct Object Reference |
| CVE-2024-10452 | Organization admins can delete pending invites created in an organization they are not part of. |
| CVE-2024-10497 | CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to mod... |
| CVE-2024-10654 | TOTOLINK LR350 formLoginAuth.htm authorization |
| CVE-2024-10666 | Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure |
| CVE-2024-10667 | Content Slider Block – Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Discl... |
| CVE-2024-10669 | Countdown Timer block – Display the event's date into a timer. <= 1.2.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10670 | Primary Addon for Elementor <= 1.6.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10671 | Button Block – Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10688 | Attesa Extra <= 1.4.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10689 | XLTab – Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10690 | Shortcodes for Elementor <= 1.0.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10692 | PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.8.1 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10693 | SKT Addons for Elementor <= 3.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10695 | Futurio Extra <= 2.0.13 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10696 | UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor S... |
| CVE-2024-1107 | IDOR in Talya Informatics' Travel APPS |
| CVE-2024-11137 | IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary |
| CVE-2024-11275 | WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authen... |
| CVE-2024-11284 | WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover |
| CVE-2024-11285 | WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover |
| CVE-2024-11300 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-11318 | IDOR vulnerability in AbsysNet |
| CVE-2024-12472 | Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2024-12483 | Dromara UJCMS User ID id authorization |
| CVE-2024-12812 | WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information |
| CVE-2024-1286 | Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure |
| CVE-2024-12880 | Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow |
| CVE-2024-1313 | Users outside an organization can delete a snapshot with its key |
| CVE-2024-10925 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-12046 | Medical Addon for Elementor <= 1.6.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information... |
| CVE-2024-12059 | ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read |
| CVE-2024-12061 | Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12062 | Charity Addon for Elementor <= 1.3.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12099 | Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12102 | Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12103 | Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure |
| CVE-2024-12114 | FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Referen... |
| CVE-2024-12116 | Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.1 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12131 | WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure... |
| CVE-2024-12132 | WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecur... |
| CVE-2024-10855 | Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Del... |
| CVE-2024-10868 | Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-11146 | TrueFiling authorization bypass via user-controlled keys |
| CVE-2024-11167 | Improper Access Control in danny-avila/librechat |
| CVE-2024-11181 | Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-11216 | Broken Access Control in PozitifIK's Pik Online |
| CVE-2024-11915 | RRAddons for Elementor <= 1.1.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12447 | Get Post Content Shortcode <= 0.4 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Di... |
| CVE-2024-12767 | BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR |
| CVE-2024-1295 | The Events Calendar (Free < 6.4.0.1, Pro < 6.4.0.1) - Contributor+ Arbitrary Events Access |
| CVE-2024-13040 | Quanta Computer QOCA aim - Authorization Bypass |
| CVE-2024-13063 | IDOR in Akinsoft's MyRezzta |
| CVE-2024-13407 | Omnipress <= 1.5.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-13425 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion |
| CVE-2024-13428 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion |
| CVE-2024-13175 | IDOR in Vidco Software's VOC TESTER |
| CVE-2024-10770 | Envo Extra <= 1.9.3 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10775 | Piotnet Addons For Elementor <= 2.4.32 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10777 | AnyWhere Elementor <= 1.2.11 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10778 | BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10779 | Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10780 | Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10782 | Theme Builder For Elementor <= 1.2.2 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10787 | LA-Studio Element Kit for Elementor <= 1.4.4 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10794 | Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10795 | Popularis Extra <= 1.2.7 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10796 | If-So Dynamic Content Personalization <= 1.9.2.1 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10797 | Full Screen Menu for Elementor <= 1.0.7 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-10798 | Royal Elementor Addons and Templates <= 1.7.1003 - Authenticated (Contributor+) Post Disclosure |
| CVE-2024-12305 | Object-Level Access Control Vulnerability Allows Unauthorized Access to Student Grades in Unifiedtransform |
| CVE-2024-12306 | Access Control Vulnerabilities Allow Unauthorized Access to User Profiles in Unifiedtransform |
| CVE-2024-12309 | Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts |
| CVE-2024-12335 | Avada Builder <= 3.11.12 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2024-2574 | SourceCodester Employee Task Management System edit-task.php authorization |
| CVE-2024-2575 | SourceCodester Employee Task Management System task-details.php authorization |
| CVE-2024-2576 | SourceCodester Employee Task Management System update-admin.php authorization |
| CVE-2024-2577 | SourceCodester Employee Task Management System update-employee.php authorization |
| CVE-2024-29020 | JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked |
| CVE-2024-31291 | WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability |
| CVE-2024-31296 | WordPress BookingPress plugin <= 1.0.81 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32772 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32808 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2024-32823 | WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-36399 | Kanboard affected by Project Takeover via IDOR in ProjectPermissionController |
| CVE-2024-38701 | WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability |
| CVE-2024-39897 | Cache driver GetBlob() allows read access to any blob without access control check |
| CVE-2024-1330 | Kadence Blocks Pro < 2.3.8 - Contributor+ Arbitrary Option Access |
| CVE-2024-13372 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download |
| CVE-2024-13740 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscribe... |
| CVE-2024-13832 | Ultra Addons Lite for Elementor <= 1.1.8 - Authenticated (Contributor+) Restricted Post Disclosure |
| CVE-2024-13841 | Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disc... |
| CVE-2024-20513 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices co... |
| CVE-2024-22439 | Certain HPE FlexNetwork and FlexFabric Switches, Remote Authentication Bypass |
| CVE-2024-2441 | VikBooking < 1.6.8 - Insecure Direct Object References |
| CVE-2024-29181 | @strapi/plugin-content-manager leaks data via relations via the Admin Panel |
| CVE-2024-29194 | OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation |
| CVE-2024-30507 | WordPress Molongui Authorship plugin <= 4.7.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-30513 | WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-30543 | WordPress Whizzy plugin <= 1.1.18 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-31095 | WordPress Thumbs Rating plugin <= 5.1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-33542 | WordPress Crelly Slider plugin <= 1.4.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-35659 | WordPress KiviCare plugin <= 3.6.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-37277 | WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-37889 | MyFinances Allows Unauthorized Access to Other Customer Data |
| CVE-2024-39319 | aimeos/ai-controller-frontend has IDOR vulnerability in account profile page |
| CVE-2024-39321 | Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes |
| CVE-2024-4151 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-4154 | Incorrect Synchronization in lunary-ai/lunary |
| CVE-2024-42422 | Dell NetWorker, version(s) 19.10, contain(s) an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenti... |
| CVE-2024-13429 | WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion |
| CVE-2024-13558 | NP Quote Request for WooCommerce <= 1.9.179 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Discl... |
| CVE-2024-13601 | Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direc... |
| CVE-2024-13607 | JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.8 - Authenticated (Subscriber+) Insecure Direct Object Referenc... |
| CVE-2024-13873 | WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection |
| CVE-2024-13887 | Business Directory Plugin - Easy Listing Directories for WordPress <= 6.4.14 - Insecure Direct Object Reference to Listing Ar... |
| CVE-2024-1470 | Elevation of Privilege attack on NetIQ Client login extension |
| CVE-2024-1604 | Incorrect authorization in BMC Control-M |
| CVE-2024-1625 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-1626 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-22206 | @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) |
| CVE-2024-22305 | WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object Referen... |
| CVE-2024-2231 | Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR |
| CVE-2024-29024 | JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality |
| CVE-2024-32604 | WordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-32683 | WordPress WP Ultimate Review plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-3748 | SP Project & Document Manager <= 4.71 - Data Update via IDOR |
| CVE-2024-3749 | SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR |
| CVE-2024-38827 | Spring Security Authorization Bypass for Case Sensitive Comparisons |
| CVE-2024-39642 | WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-1744 | IDOR in Ariva Computer's Accord ORS |
| CVE-2024-21759 | An authorization bypass through user-controlled key in Fortinet FortiPortal version 7.2.0, and versions 7.0.0 through 7.0.6 a... |
| CVE-2024-22455 | Dell Mobility - E-Lab Navigator, version(s) 3.1.9, 3.2.0, contain(s) an Authorization Bypass Through User-Controlled Key vuln... |
| CVE-2024-23112 | An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 thr... |
| CVE-2024-25983 | Msa-24-0006: idor on dashboard comments block |
| CVE-2024-27302 | Authorization Bypass Through User-Controlled Key in go-zero |
| CVE-2024-3035 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-31898 | IBM InfoSphere Information Server data modification |
| CVE-2024-3305 | IDOR in Utarit Information's SoliClub |
| CVE-2024-3306 | IDOR in Utarit Information's SoliClub |
| CVE-2024-34383 | WordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerability |
| CVE-2024-34457 | Apache StreamPark IDOR Vulnerability |
| CVE-2024-43350 | WordPress Propovoice CRM plugin <= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-4341 | IDOR in ExtremePacs's Extreme XDS |
| CVE-2024-4464 | Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680,... |
| CVE-2024-45032 | A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Vir... |
| CVE-2024-45605 | Improper authorization on deletion of user issue alert notifications in sentry |
| CVE-2024-45606 | Improper authorization on muting of alert rules in sentry |
| CVE-2024-45614 | Header normalization allows for client to clobber proxy set headers in Puma |
| CVE-2024-4565 | Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access |
| CVE-2024-45786 | Improper Authorization Vulnerability |
| CVE-2024-45806 | Potential manipulate `x-envoy` headers from external sources in envoy |
| CVE-2024-47316 | WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-47495 | Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device. |
| CVE-2024-47657 | Improper Access Control Vulnerability |
| CVE-2024-49388 | Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect... |
| CVE-2024-51559 | Improper Access Control Vulnerability in Wave 2.0 |
| CVE-2024-5166 | Insecure Direct Object Reference In Looker |
| CVE-2024-52507 | Share information of the Nextcloud Tables app is not limited to affected users |
| CVE-2024-52511 | Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables |
| CVE-2024-5258 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-52601 | iTop portal Insecure Direct Object Reference vulnerability |
| CVE-2024-6087 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-6357 | Insecure Direct Object Reference vulnerability |
| CVE-2024-42463 | Leak of organizations messages |
| CVE-2024-42464 | Leak of user information |
| CVE-2024-4750 | BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment |
| CVE-2024-4843 | ePO doesn't allow a regular privileged user to delete tasks or assignments. Insecure direct object references that allow a le... |
| CVE-2024-4886 | BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR |
| CVE-2024-50395 | Media Streaming add-on |
| CVE-2024-50483 | WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability |
| CVE-2024-52294 | khoj has an IDOR in subscription management that allows unauthorized subscription modifications |
| CVE-2024-52313 | data.all authenticated users can obtain incorrect object level authorizations |
| CVE-2024-5973 | MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor |
| CVE-2024-5977 | GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worke... |
| CVE-2024-6685 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2024-7848 | User Private Files <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access |
| CVE-2024-8428 | ForumWP – Forum & Discussion Board Plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privileg... |
| CVE-2024-8613 | Improper Access Control in gaizhenbiao/chuanhuchatgpt |
| CVE-2024-9215 | Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.7.1 - Insecure Direct Object R... |
| CVE-2024-42169 | HCL MyXalytics is affected by insecure direct object references |
| CVE-2024-43239 | WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability |
| CVE-2024-43266 | WordPress WP Job Portal – A Complete Job Board plugin <= 2.1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43288 | WordPress wpForo Forum plugin <= 2.3.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43315 | WordPress Stripe Payments For WooCommerce plugin <= 1.9.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43322 | WordPress Zephyr Project Manager plugin <= 3.3.100 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-43916 | WordPress Zephyr Project Manager plugin <= 3.3.102 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2024-45329 | A authorization bypass through user-controlled key in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and... |
| CVE-2024-4537 | IDOR vulnerability in Janto Ticketing Software |
| CVE-2024-4538 | IDOR vulnerability in Janto Ticketing Software |
| CVE-2024-4665 | EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update |
| CVE-2024-46982 | Cache Poisoning in next.js |
| CVE-2024-5128 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-5130 | Incorrect Authorization in lunary-ai/lunary |
| CVE-2024-5131 | Improper Access Control in lunary-ai/lunary |
| CVE-2024-5333 | The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure |
| CVE-2024-56143 | Strapi Allows Unauthorized Access to Private Fields via parms.lookup |
| CVE-2024-5619 | IDOR in PruvaSoft Informatics' Apinizer Management Console |
| CVE-2024-6534 | Directus 10.13.0 - Insecure object reference via PATH presets |
| CVE-2024-7040 | Improper Access Control in open-webui/open-webui |
| CVE-2024-7041 | IDOR in open-webui/open-webui |
| CVE-2024-8040 | Authorization Bypass Through User-Controlled Key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x |
| CVE-2024-8261 | IDOR in Proliz Software's OBS |
| CVE-2024-8290 | WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Obje... |
| CVE-2024-8292 | WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary... |
| CVE-2024-8791 | Donation Forms by Charitable – Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Ref... |
| CVE-2024-9097 | IDOR |
| CVE-2024-9554 | Sovell Smart Canteen System Password Reset suanfa.py Check_ET_CheckPwdz201 authorization |
| CVE-2024-9617 | IDOR in danswer-ai/danswer |
| CVE-2025-0058 | Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow |
| CVE-2025-0606 | IDOR in Logo Software's Logo Cloud |
| CVE-2025-0875 | IDOR in Proliz Software's OBS |
| CVE-2024-9637 | School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Tak... |
| CVE-2024-9687 | WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass |
| CVE-2024-9700 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submissio... |
| CVE-2024-9819 | IDOR in NextGEO's NG Analyser |
| CVE-2024-9862 | Miniorange OTP Verification with Firebase <= 3.6.0 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-0337 | Authorization bypass in Now Platform |
| CVE-2025-0352 | Rapid Response Monitoring My Security Account App Authorization Bypass Through User-Controlled Key |
| CVE-2025-0640 | IDOR in Akinsoft's OctoCloud |
| CVE-2025-0642 | Hard-coded Credentials in PosCube's Assist |
| CVE-2025-0661 | DethemeKit For Elementor <= 2.1.8 - Authenticated (Contributor+) Protected Post Disclosure |
| CVE-2025-0670 | IDOR in Akinsoft's ProKuafor |
| CVE-2025-10719 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2025-10720 | WP Private Content Plus <= 3.6.2 - Password Protection Bypass |
| CVE-2025-10742 | Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change |
| CVE-2024-7473 | IDOR Vulnerability in lunary-ai/lunary |
| CVE-2024-7474 | IDOR in lunary-ai/lunary |
| CVE-2024-7476 | Broken Access Control in lunary-ai/lunary |
| CVE-2024-8123 | The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference |
| CVE-2024-8158 | User impersonation for lib9p based 9p fileservers |
| CVE-2024-8485 | REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover |
| CVE-2024-8601 | Improper Access Control Vulnerability in TechExcel Back Office Software |
| CVE-2024-8988 | PeepSo Core: File Uploads <= 6.4.6.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via... |
| CVE-2024-9262 | User Meta – User Profile Builder and User management plugin <= 3.1 - Insecure Direct Object Reference to Sensitive Informatio... |
| CVE-2024-9263 | WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Referenc... |
| CVE-2025-0987 | IDOR in CB Project's CVLand |
| CVE-2025-10759 | Webkul QloApps CSRF Token authorization |
| CVE-2025-11321 | zhuimengshaonian wisdom-education WrongBookController.java authorization |
| CVE-2025-11741 | WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure |
| CVE-2025-11748 | Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join |
| CVE-2025-12283 | code-projects Client Details System authorization |
| CVE-2024-39900 | OpenSearch Dashboards Reports does not properly restrict access to private tenant resources |
| CVE-2025-10493 | Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie |
| CVE-2025-10570 | Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary O... |
| CVE-2025-11176 | Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation |
| CVE-2025-11690 | IDOR vulnerability in the CFMOTO RIDE API |
| CVE-2025-11895 | Binary MLM Plan <= 3.0 - Authenticated (Subscriber+) Insecure Direct Object Reference |
| CVE-2025-11957 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated... |
| CVE-2025-12833 | GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authentic... |
| CVE-2025-1284 | Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) <= 4.1 - Insecure Direct Object Reference t... |
| CVE-2025-12854 | newbee-mall-plus seckillExecution executeSeckill authorization |
| CVE-2025-12903 | Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud |
| CVE-2025-20114 | Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability |
| CVE-2025-22608 | Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) |
| CVE-2025-24315 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-24969 | iTop portal user can see any other contact's picture |
| CVE-2025-24976 | Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT |
| CVE-2025-10947 | Sistemas Pleno Gestão de Locação CPF validarCpf authorization |
| CVE-2025-11517 | Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass |
| CVE-2025-11518 | WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-11519 | Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload |
| CVE-2025-11532 | Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation |
| CVE-2025-12087 | Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishl... |
| CVE-2025-12126 | The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation |
| CVE-2025-12623 | fushengqian fuint Authentication Token ClientSignController.java authorization |
| CVE-2025-1270 | Insecure direct object reference (IDOR) vulnerability in H6Web |
| CVE-2025-1327 | Homey - Booking and Rentals WordPress Theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitr... |
| CVE-2025-1607 | SourceCodester Best Employee Management System salary_slip.php authorization |
| CVE-2025-1667 | School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover |
| CVE-2025-2301 | IDOR in Akbim Software's Online Exam Registration |
| CVE-2025-24850 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2024-39901 | OpenSearch Observability does not properly restrict access to private tenant resources |
| CVE-2025-28874 | WordPress BP Email Assign Templates By shanebp plugin <= 1.6 - Arbitrary Content Deletion vulnerability |
| CVE-2025-30514 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-30777 | WordPress Support Genix <= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-3089 | Broken Access Control in ServiceNow AI Platform |
| CVE-2025-31357 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31360 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-26660 | Broken Access Control in SAP Fiori apps (Posting Library) |
| CVE-2025-26965 | WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-26977 | WordPress FileBird plugin <= 6.4.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-27507 | IDOR Vulnerabilities in ZITADEL's Admin API that Primarily Impact LDAP Configurations |
| CVE-2025-27561 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27927 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27929 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27938 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27939 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3091 | MB connect line: Authorization bypass in mbCONNECT24/mymbCONNECT24 |
| CVE-2025-31654 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31950 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-12288 | Bdtask Pharmacy Management System User Profile edit_user authorization |
| CVE-2025-12351 | Inadequate access control measure allows unauthorized users to access restricted administrative functions |
| CVE-2025-12353 | WPFunnels <= 3.6.2 - Unauthorized User Registration |
| CVE-2025-12366 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference |
| CVE-2025-1469 | IDOR in Turtek Software's Eyotek |
| CVE-2025-20214 | A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticat... |
| CVE-2025-22695 | WordPress Nirweb support plugin <= 3.0.3 - Broken Access Control vulnerability |
| CVE-2025-2271 | IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.asp |
| CVE-2025-24487 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-2526 | Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover |
| CVE-2025-25276 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-25282 | Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow |
| CVE-2025-2563 | User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation |
| CVE-2025-2594 | User Registration & Membership < 4.1.3 - Authentication Bypass |
| CVE-2025-31147 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31833 | WordPress JobBoard Job listing plugin Plugin <= 1.2.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31867 | WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-31933 | Growatt Cloud Applications Authorization Bypass Through User-Controlled Key |
| CVE-2025-31941 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31945 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-31949 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3281 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Ref... |
| CVE-2025-34140 | ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix |
| CVE-2025-3519 | Replace uploaded files knowing the file upload ID |
| CVE-2025-3574 | Insecure Direct Object Reference on Deporsite by T-INNOVA |
| CVE-2025-3575 | Insecure Direct Object Reference en Deporsite de T-INNOVA |
| CVE-2025-3636 | Moodle: idor in moodle rss block allows unauthorized access to rss feeds |
| CVE-2025-3640 | Moodle: idor in web service allows users enrolled in a course to access some details of other users |
| CVE-2025-3853 | WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Gene... |
| CVE-2025-3874 | WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference |
| CVE-2025-3889 | WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference via 'quantity' |
| CVE-2025-39537 | WordPress WP JobHunt <= 7.1 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-4040 | IDOR in Turpak's Automatic Station Monitoring System |
| CVE-2025-40773 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broke... |
| CVE-2025-41020 | Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito |
| CVE-2025-41069 | Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite |
| CVE-2025-41091 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41092 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41093 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41094 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41095 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41096 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41097 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-26788 | StrongKey FIDO Server before 4.15.1 treats a non-discoverable (namedcredential) flow as a discoverable transaction. |
| CVE-2025-26857 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27433 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) |
| CVE-2025-27436 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) |
| CVE-2025-27565 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27568 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27575 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-27719 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-30254 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-30257 | Growatt Cloud portal Authorization Bypass Through User-Controlled Key |
| CVE-2025-3282 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Ref... |
| CVE-2025-3292 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Ref... |
| CVE-2025-36023 | IBM Cloud Pak for Business Automation security bypass |
| CVE-2025-3605 | Frontend Login and Registration Blocks <= 1.0.7 - Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-3610 | Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update |
| CVE-2025-3625 | Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action |
| CVE-2025-31997 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR) |
| CVE-2025-32373 | DNN allows a registered user to enumerate and access files they should not have access to |
| CVE-2025-34293 | GN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure |
| CVE-2025-3769 | Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference |
| CVE-2025-3810 | WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover |
| CVE-2025-3811 | WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update |
| CVE-2025-39434 | WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-40650 | Insecure Direct Object Reference (IDOR) in Clickedu |
| CVE-2025-40658 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40659 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40660 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40661 | Insecure Direct Object Reference (IDOR) vulnerability in DM Corporative CMS |
| CVE-2025-40676 | Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC |
| CVE-2025-53357 | GLPI permits reservation modification by unauthorized users |
| CVE-2025-5518 | IDOR in ArgusTech's BILGER |
| CVE-2025-5526 | BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update |
| CVE-2025-57886 | WordPress Accessibility Checker by Equalize Digital Plugin <= 1.30.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-61779 | Trustee's attestation-policy endpoint is not protected by admin autentication |
| CVE-2025-4210 | Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization |
| CVE-2025-43782 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th... |
| CVE-2025-43790 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 th... |
| CVE-2025-43803 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119... |
| CVE-2025-43810 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, an... |
| CVE-2025-43827 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older... |
| CVE-2025-4855 | Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key |
| CVE-2025-49952 | WordPress Houzez Theme <= 4.1.1 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-5261 | IDOR in PozitifIK's Pik Online |
| CVE-2025-54691 | WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-5681 | IDOR in Turtek Software's Eyotek |
| CVE-2025-58137 | Apache Fineract: IDOR via self-service API |
| CVE-2025-58597 | WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58627 | WordPress Miraculous Core Plugin plugin < 2.0.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-64431 | IDOR Vulnerabilities in ZITADEL's Organization API allows Cross-Tenant Data Tempering |
| CVE-2025-64706 | Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure |
| CVE-2025-5947 | Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie |
| CVE-2025-5948 | Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business |
| CVE-2025-5949 | Service Finder Bookings <= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password |
| CVE-2025-59562 | WordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-62241 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allo... |
| CVE-2025-62242 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and... |
| CVE-2025-62244 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay... |
| CVE-2025-62252 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versio... |
| CVE-2025-63043 | WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.19 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-63053 | WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-63065 | WordPress Media LIbrary Assistant plugin <= 3.29 - Broken Access Control vulnerability |
| CVE-2025-6329 | ScriptAndTools Real Estate Management System User Delete userdelete.php authorization |
| CVE-2025-64282 | WordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-64283 | WordPress RTMKit plugin <= 1.6.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-64497 | Tuleap exposes releases for all projects to File Release System project administrators |
| CVE-2025-41098 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-41099 | Insecure Direct Object Reference in GPS BOLD Workplanner |
| CVE-2025-4129 | IDOR in PAVO Inc.'s PAVO Pay |
| CVE-2025-46386 | CWE-639 Authorization Bypass Through User-Controlled Key |
| CVE-2025-46387 | CWE-639 Authorization Bypass Through User-Controlled Key |
| CVE-2025-4691 | Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to... |
| CVE-2025-4796 | Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover |
| CVE-2025-5182 | Summer Pearl Group Vacation Rental Management Platform Listing authorization |
| CVE-2025-5195 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-52446 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api mo... |
| CVE-2025-52447 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sq... |
| CVE-2025-52448 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initi... |
| CVE-2025-65020 | Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65021 | Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR) |
| CVE-2025-65028 | Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes |
| CVE-2025-65029 | Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants |
| CVE-2025-65030 | Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal |
| CVE-2025-65031 | Rallly Improper Authorization in Comment Endpoint Allows User Impersonation |
| CVE-2025-65032 | Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names |
| CVE-2025-65033 | Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation |
| CVE-2025-65034 | Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId |
| CVE-2025-65096 | RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections |
| CVE-2025-65097 | Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections |
| CVE-2025-65098 | Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass |
| CVE-2025-66513 | Nextcloud Tables app share information not limited to relevant users |
| CVE-2025-66546 | Nextcloud Calendar app allowed booking appointments without the generated token |
| CVE-2025-66547 | Nextcloud Server users can modify tags on files that do not belong to them |
| CVE-2025-66551 | Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users |
| CVE-2025-66553 | Nextcloud Tables app allowed users to view columns metadata information of any table |
| CVE-2025-66556 | Nextcloud talk allows participants to blindly delete poll drafts of other users by ID |
| CVE-2025-67909 | WordPress Membership For WooCommerce plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67919 | WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-67985 | WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68492 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerabi... |
| CVE-2025-42605 | Improper Access Control Vulnerability in Meon Bidding Solutions |
| CVE-2025-43724 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability... |
| CVE-2025-43732 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1... |
| CVE-2025-49135 | CVAT missing validation for in-progress backup upload names |
| CVE-2025-49978 | WordPress JobSearch plugin <= 2.9.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-49995 | WordPress Download Attachments plugin <= 1.3.1 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-53208 | WordPress Maya Business <= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-53640 | Indico vulnerable to user enumeration via API endpoint |
| CVE-2025-55737 | flaskBlog arbitrary comment delete |
| CVE-2025-57994 | WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58012 | WordPress Content Mask Plugin <= 1.8.5.2 - Insecure Direct Object References (IDOR) Vulnerability |
| CVE-2025-58055 | Discourse AI Suggestions Contain Insecure Direct Object Reference |
| CVE-2025-59034 | Indico may disclose unauthorized user details access via legacy API |
| CVE-2025-6038 | Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privi... |
| CVE-2025-61950 | In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly... |
| CVE-2025-62893 | Без описания... |
| CVE-2025-66306 | Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel |
| CVE-2025-67594 | WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68044 | WordPress Five Star Restaurant Reservations plugin <= 2.7.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68051 | WordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68071 | WordPress Essential Real Estate plugin <= 5.2.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68975 | WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68979 | WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68997 | WordPress wpDiscuz plugin <= 7.6.40 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-8755 | macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization |
| CVE-2025-8855 | 2FA Expiry Bypass in Optimus Software's Brokerage Automation |
| CVE-2025-8884 | IDOR in VHS Electronic Software's ACE Center |
| CVE-2025-8887 | IDOR in Usta Information Systems' Aybs Interaktif |
| CVE-2025-9520 | IDOR Leading to Owner Account Hijacking in Omada Controller |
| CVE-2025-9559 | Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface... |
| CVE-2026-1375 | Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deleti... |
| CVE-2026-1389 | Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Del... |
| CVE-2026-1436 | Improper Access Control (IDOR) vulnerability in Graylog Web Interface |
| CVE-2025-64516 | GLPI incorrectly authorizes access to documents |
| CVE-2025-64523 | FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function |
| CVE-2025-6574 | Service Finder Bookings < 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover |
| CVE-2025-66132 | WordPress FAPI Member plugin <= 2.2.26 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-66558 | Nextcloud Twofactor WebAuthn app was updated based on public key |
| CVE-2025-6833 | All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authen... |
| CVE-2025-69207 | Khoj has an IDOR in Notion OAuth Flow Enables Index Poisoning |
| CVE-2025-69274 | Spectrum broken authorization scheme |
| CVE-2025-7013 | IDOR in QRMenumPro's Menu Panel |
| CVE-2025-7049 | WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover |
| CVE-2025-7733 | WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference |
| CVE-2025-8057 | IDOR in Patika Global Technologies' HumanSuite |
| CVE-2025-8447 | Incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed read-only access |
| CVE-2025-8463 | IDOR in SecHard Information Technologies' SecHard |
| CVE-2026-0909 | WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Paramet... |
| CVE-2026-1080 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-1496 | Coverity CLI Authentication Bypass |
| CVE-2026-1558 | WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'rec... |
| CVE-2026-1619 | IDOR in Universal Sotware's FlexCity/Kiosk |
| CVE-2026-2028 | Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter |
| CVE-2026-22489 | WordPress Image Slider Slideshow plugin <= 1.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-2257 | GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Stored Cross-Site Scripting via REST API |
| CVE-2026-22588 | Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification |
| CVE-2026-22589 | Spree API has Unauthenticated IDOR - Guest Address |
| CVE-2026-2347 | IDOR in Akıllı Ticaret's E-Commerce Pack |
| CVE-2026-23478 | Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback |
| CVE-2026-23487 | Blinko: IDOR - user.detail Endpoint Leaks Superadmin Token |
| CVE-2026-23488 | Blinko: multiple interfaces in the comment feature allow unauthorized access |
| CVE-2026-23522 | Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion |
| CVE-2026-24599 | WordPress NextMove Lite plugin <= 2.23.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-2461 | Missing authorization check allows unauthorized modification of other users' comments on a board |
| CVE-2026-24900 | MarkUs has a submission-view IDOR exposes all student submissions |
| CVE-2025-68502 | WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-68514 | WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69029 | WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69030 | WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69032 | WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-69202 | axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header |
| CVE-2025-69394 | WordPress Cnvrse plugin <= 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2025-6942 | The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an... |
| CVE-2025-7347 | IDOR in Dinibh Puzzle's Dinibh Patrol Tracking System |
| CVE-2025-7355 | IDOR in Beefull Energy Technologies' Beefull App |
| CVE-2025-7718 | Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Refere... |
| CVE-2025-7899 | Insecure Direct Object Reference in extension "powermail" (powermail) |
| CVE-2025-7900 | Insecure Direct Object Reference in extension "femanager" (femanager) |
| CVE-2025-7938 | jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java updateGoods authorization |
| CVE-2025-8532 | IDOR in Bimser's eBA Document and Workflow Management System |
| CVE-2025-8770 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2025-8789 | Portabilis i-Educar API Endpoint Diario authorization |
| CVE-2025-8794 | LitmusChaos Litmus LocalStorage authorization |
| CVE-2025-9062 | IDOR in MeCODE Informatics' Envanty |
| CVE-2025-9081 | IDOR in board file download allows any user to download any file by UUID |
| CVE-2025-9114 | Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change |
| CVE-2025-9342 | IDOR in Anadolu Hayat Emeklilik's AHE Mobile |
| CVE-2025-9835 | macrozheng mall cancelUserOrder cancelOrder authorization |
| CVE-2025-9836 | macrozheng mall paySuccess authorization |
| CVE-2025-9902 | IDOR in Akınsoft QRMenu |
| CVE-2026-1201 | Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs |
| CVE-2026-1206 | Elementor Website Builder <= 3.35.7 - Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure... |
| CVE-2026-1213 | Askbot 0.12.2 - Insecure Direct Object Reference (IDOR) |
| CVE-2026-1219 | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Referen... |
| CVE-2026-1228 | Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode... |
| CVE-2026-1251 | SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Refere... |
| CVE-2026-1271 | ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Ima... |
| CVE-2026-1883 | Wicked Folders <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Folder Deletion |
| CVE-2026-1947 | NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modi... |
| CVE-2026-1987 | Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification |
| CVE-2026-1992 | ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation |
| CVE-2026-21409 | Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted... |
| CVE-2026-21447 | Bagisto has IDOR in Customer Order Reorder Functionality |
| CVE-2026-22383 | WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulner... |
| CVE-2026-22391 | WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22393 | WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22396 | WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22398 | WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22400 | WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22404 | WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22406 | WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22407 | WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22409 | WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22411 | WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22426 | WordPress Sweet Jane theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22430 | WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24134 | StudioCMS has an Authorization Bypass Through User-Controlled Key |
| CVE-2026-24136 | Saleor has an Insecure Direct Object Reference (IDOR) in GraphQL API |
| CVE-2026-2414 | Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects... |
| CVE-2026-24178 | NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated a... |
| CVE-2026-25757 | Unauthenticated Spree Commerce users can view completed guest orders by Order ID |
| CVE-2026-25758 | Spree allows unauthenticated users can access all guest addresses |
| CVE-2026-25927 | OpenEMR Missing Authorization Checks in DICOM Viewer State API |
| CVE-2026-25929 | OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval |
| CVE-2026-25930 | OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms |
| CVE-2026-2997 | WisdomGarden｜Tronclass - Insecure Direct Object Reference |
| CVE-2026-3020 | Identity based authorization bypass vulnerability (IDOR) in the Wakyma application web |
| CVE-2026-30230 | Flare: Password‑Protected Thumbnail Bypass |
| CVE-2026-30231 | Flare: Private File IDOR via raw/direct endpoints |
| CVE-2026-3073 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-3074 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-30823 | Flowise: IDOR leading to Account Takeover and Enterprise Feature Bypass via SSO Configuration |
| CVE-2026-30825 | hoppscotch: IDOR - Any authenticated user can revoke any other user's Personal Access Token |
| CVE-2026-30843 | Wekan has Cross-Board IDOR in Custom Fields Update Endpoints |
| CVE-2026-30857 | WeKnora: Unauthorized Cross‑Tenant Knowledge Base Cloning |
| CVE-2026-30884 | mdjnelson/moodle-mod_customcert Vulnerable to Authorization Bypass Through User-Controlled Key |
| CVE-2026-1664 | Insecure Direct Object Reference (IDOR) via Header-Based Email Routing |
| CVE-2026-1704 | Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information E... |
| CVE-2026-1753 | Gutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options Update |
| CVE-2026-20897 | Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) |
| CVE-2026-20904 | Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes |
| CVE-2026-20912 | Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure |
| CVE-2026-2104 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-22234 | OPEXUS eCasePortal unauthenticated IDOR |
| CVE-2026-22235 | OPEXUS eComplaint IDOR |
| CVE-2026-2230 | Booking Calendar <= 10.14.14 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Settings Modifi... |
| CVE-2026-2366 | Keycloak: keycloak: information disclosure via authorization bypass in admin api |
| CVE-2026-23754 | D-Link D-View 8 IDOR Allows Credential Disclosure and Account Takeover |
| CVE-2026-23843 | teklifolustur_app's IDOR vulnerability allows unauthorized access to other users' offers |
| CVE-2026-24379 | WordPress WP Job Portal plugin <= 2.4.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24631 | WordPress Rosebud theme <= 1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24634 | WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24773 | Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Files |
| CVE-2026-24776 | OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer |
| CVE-2026-25147 | OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid |
| CVE-2026-25197 | Gardyn Cloud API Authorization Bypass Through User-Controlled Key |
| CVE-2026-25220 | OpenEMR Messages "Show All" Not Restricted to Admins |
| CVE-2026-25324 | WordPress Quiz And Survey Master plugin <= 10.3.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25497 | Craft has a GraphQL Asset Mutation Privilege Escalation |
| CVE-2026-25530 | Kanboard is missing authorization check in getSwimlane API allows cross-project data access |
| CVE-2026-2554 | WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendo... |
| CVE-2026-25563 | WeKan < 8.19 Checklist Creation Cross-Board IDOR |
| CVE-2026-25564 | WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation |
| CVE-2026-25567 | WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId |
| CVE-2026-25574 | Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) |
| CVE-2026-26004 | Sentry allows unauthorized access to event data across organizational boundaries |
| CVE-2026-26016 | Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization |
| CVE-2026-26078 | Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint |
| CVE-2026-27397 | WordPress Really Simple Security Pro plugin <= 9.5.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-27449 | Umbraco.Engage.Forms Allows Unauthorized Access to Multiple API Endpoints |
| CVE-2026-27705 | Plane Vulnerable to Cross-Workspace/Cross-Project Asset Modification via IDOR in ProjectAssetEndpoint.patch |
| CVE-2026-27793 | Seerr has Broken Object-Level Authorization in User Profile Endpoint that Exposes Third-Party Notification Credentials |
| CVE-2026-27835 | wger: IDOR in RepetitionsConfig and MaxRepetitionsConfig API leak other users' workout data |
| CVE-2026-27838 | wger: IDOR via user-unscoped cache keys on routine API actions exposes workout data |
| CVE-2026-27839 | wger: IDOR in nutritional_values endpoints exposes private dietary data via direct ORM lookup |
| CVE-2026-28216 | hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment |
| CVE-2026-28225 | Manyfold has IDOR in ModelFilesController |
| CVE-2026-28354 | ClipBucket v5 has IDOR in Collection Item Management |
| CVE-2026-28361 | NocoDB: Missing Ownership Validation in MCP Token Operations |
| CVE-2026-28433 | Misskey lacks resource ownership validation |
| CVE-2026-28696 | Craft affected by IDOR via GraphQL @parseRefs |
| CVE-2026-28736 | Focalboard IDOR in file content endpoint allows cross-user file access (unsupported product, no fix) |
| CVE-2026-28747 | Milesight Cameras Authorization Bypass Through User-Controlled Key |
| CVE-2026-28781 | Craft Affected by Entries Authorship Spoofing via Mass Assignment |
| CVE-2026-28782 | Craft has a Permission Bypass and IDOR in Duplicate Entry Action |
| CVE-2026-3124 | Download Monitor <= 5.1.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'o... |
| CVE-2026-3139 | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object... |
| CVE-2026-31820 | Sylius affected by IDOR in Cart and Checkout LiveComponents |
| CVE-2026-31832 | Umbraco Backoffice API Allows Unauthorized Modification of Domain Data |
| CVE-2026-3185 | feiyuchuixue sz-boot-parent API Endpoint sys-message authorization |
| CVE-2026-31867 | Craft Commerce has a Potential IDOR in Commerce carts |
| CVE-2026-31869 | Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check |
| CVE-2026-31874 | Taskosaur Improper Role Assignment via Parameter Manipulation in User Registration |
| CVE-2026-32039 | OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender |
| CVE-2026-32097 | PingPong has improper access control in thread file endpoints allows access outside intended scope |
| CVE-2026-32103 | StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation |
| CVE-2026-32104 | StudioCMS: IDOR in User Notification Preferences Allows Any Authenticated User to Modify Any User's Settings |
| CVE-2026-32114 | Discourse's unscoped status lookups leak restricted metadata |
| CVE-2026-32120 | OpenEMR has IDOR in Fee Sheet Product Save |
| CVE-2026-33663 | n8n Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition |
| CVE-2026-33678 | Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion |
| CVE-2026-33700 | Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion |
| CVE-2026-33702 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) |
| CVE-2026-33703 | Chamilo LMS Critical IDOR: Any Authenticated User Can Extract All Users’ Personal Data and API Tokens |
| CVE-2026-3371 | Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification |
| CVE-2026-33724 | n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no |
| CVE-2026-33730 | Open Source Point of Sale has an IDOR in Password Change (Home) |
| CVE-2026-33735 | MyTube has an Improper Access Control that Allows Complete Application Takeover |
| CVE-2026-33736 | Chamilo LMS has an Insecure Direct Object Reference (IDOR) - User Data Exposure |
| CVE-2026-33740 | EspoCRM: Email importEml can import and delete another user's attachment by raw fileId |
| CVE-2026-35584 | FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration |
| CVE-2026-3568 | MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update |
| CVE-2026-39331 | ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families |
| CVE-2026-39354 | Scoold has an Authenticated Arbitrary Question Overwrite via Client-Controlled postId in POST /questions/ask |
| CVE-2026-39374 | Plane IDOR: Cross-Project Issue Date Modification via Bulk Update Endpoint |
| CVE-2026-39384 | FreeScout Customer Merge Cross-Mailbox Authorization Bypass |
| CVE-2026-39386 | Neko has Self-service Privilege Escalation for Authenticated Users |
| CVE-2026-40252 | Broken Access Control (IDOR) Leading to Cross-Tenant Application Access in FastGPT |
| CVE-2026-40308 | My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog |
| CVE-2026-41267 | Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association |
| CVE-2026-41277 | Flowise: Mass Assignment in DocumentStore Create Endpoint Leads to Cross-Workspace Object Takeover (IDOR) |
| CVE-2026-41279 | Flowise: Unauthenticated TTS endpoint accepts arbitrary credential IDs — enables API credit abuse via stored credentials |
| CVE-2026-41406 | OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messages |
| CVE-2026-41471 | Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint |
| CVE-2026-4160 | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Ref... |
| CVE-2026-42205 | Avo: Broken Access Control: Unauthorized Execution of Arbitrary Action Classes Across Resources |
| CVE-2026-42227 | n8n: Public API Variables IDOR Allows Cross-Project Secret Disclosure |
| CVE-2026-42276 | Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions |
| CVE-2026-42277 | Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files |
| CVE-2026-42278 | UltraDAG: Smart Account Spending Policy Bypass via Pockets |
| CVE-2026-42279 | solidtime: Time entry update endpoint allows cross-organization modification of a known time-entry UUID |
| CVE-2026-43883 | WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription... |
| CVE-2026-43890 | Outline: IDOR in subscriptions.create allows cross-tenant subscription on private documents (sibling of GHSA-23jj-rp48-w7q7) |
| CVE-2026-4400 | Multiple vulnerabilities in 1millionbot Millie chatbot |
| CVE-2026-44341 | GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint |
| CVE-2026-44400 | MailEnable Enterprise Premium < 10.55 Authorization Bypass via WebAdmin |
| CVE-2026-44423 | ShellHub: Cross-tenant IDOR in `GET /api/sessions/:uid` discloses SSH session data |
| CVE-2026-44424 | ShellHub: Cross-tenant IDOR in `GET /api/devices/:uid` discloses device data of any namespace |
| CVE-2026-44426 | ShellHub: Cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check |
| CVE-2026-44504 | Aegra: Cross-user run injection in /threads/{thread_id}/runs (IDOR) |
| CVE-2026-44544 | gittuf: Policy can be rolled back to prior valid version |
| CVE-2026-4503 | Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint |
| CVE-2026-45349 | Open WebUI: Broken Access Control for Completions API |
| CVE-2026-45385 | Open WebUI: An IDOR vulnerability exists in the update_message_by_id API endpoint |
| CVE-2026-45386 | Open WebUI: An IDOR vulnerability exists in the pin_channel_message API endpoint |
| CVE-2026-45398 | Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Access Controls |
| CVE-2026-45402 | Open WebUI: Cross-User File Access via Unchecked file_id in Folder Knowledge and Knowledge-Base Attach Endpoints |
| CVE-2026-4549 | mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization |
| CVE-2026-4563 | MacCMS Member Order Detail User.php order_info authorization |
| CVE-2026-45666 | Open WebUI: Indirect Object Reference (IDOR) in user notes |
| CVE-2026-45671 | Open WebUI: shared-chat branch ignores access_type, allowing unauthorized file deletion |
| CVE-2026-45760 | Apache Camel K: Camel K Cross-Namespace Build Deputy Attack |
| CVE-2026-4630 | Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference |
| CVE-2026-46407 | Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens |
| CVE-2026-46408 | Vvveb: checkout IDOR allows unauthorized reuse of another user's cart |
| CVE-2026-4654 | Awesome Support <= 6.3.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Unauthorized Ticket Reply Access v... |
| CVE-2026-46721 | Broken Access Control in extension "Frontend User Registration" (sf_register) |
| CVE-2026-47068 | Cross-session PubSub topic injection via URL parameter in phoenix_storybook |
| CVE-2026-4896 | WCFM - WooCommerce Frontend Manager <= 6.7.25 - Insecure Direct Object References to Autenticated (Vendor+) Arbitrary Post/Pr... |
| CVE-2026-4958 | OpenBMB XAgent WebSocket Endpoint replayer.py ReplayServer.send_data authorization |
| CVE-2026-5167 | Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint |
| CVE-2026-5199 | Cross Namespace Access via Batch Operation |
| CVE-2026-5234 | LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Inv... |
| CVE-2026-5246 | Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization |
| CVE-2026-5326 | SourceCodester Leave Application System User Information index.php authorization |
| CVE-2026-5337 | Frontend File Manager Plugin <= 23.6 - Subscriber+ Arbitrary Download Access via IDOR |
| CVE-2026-5395 | Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter |
| CVE-2026-5396 | Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter |
| CVE-2026-5465 | Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Paramet... |
| CVE-2026-5617 | Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie |
| CVE-2026-5652 | Authorization Bypass Through User-Controlled Key in Crafty Controller |
| CVE-2026-5750 | Insecure direct object reference (IDOR) vulnerability in Fullstep |
| CVE-2026-5798 | Unsafe Object Reference (IDOR) vulnerability in Stel Order |
| CVE-2026-5842 | decolua 9router Administrative API Endpoint api authorization |
| CVE-2026-5845 | Improper authorization fallback allows scoped user-to-server token installation escape in GitHub Enterprise Server |
| CVE-2026-6001 | IDOR in Abis Technology's BAPSİS |
| CVE-2026-6008 | IDOR in Im Park's DijiDemi |
| CVE-2026-6063 | Authorization Bypass Through User-Controlled Key in GitLab |
| CVE-2026-6072 | Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header |
| CVE-2026-6206 | MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Quer... |
| CVE-2026-6375 | Authorization bypass through User-Controlled key in SpiceJet Online Booking System |
| CVE-2026-6542 | Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id |
| CVE-2026-6566 | Photo Gallery, Sliders, Proofing and Themes <= 4.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Image... |
| CVE-2026-6570 | kodcloud KodExplorer systemMember.class.php initInstall authorization |
| CVE-2026-6571 | kodcloud KodExplorer systemRole.class.php roleGroupAction authorization |
| CVE-2026-6583 | TransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorization |
| CVE-2026-6584 | TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization |
| CVE-2026-6585 | TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization |
| CVE-2026-6586 | TransformerOptimus SuperAGI Budget Endpoint budget.py update_budget authorization |
| CVE-2026-6612 | TransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorization |
| CVE-2026-6613 | TransformerOptimus SuperAGI agent.py get_schedule_data authorization |
| CVE-2026-6614 | TransformerOptimus SuperAGI project.py get_projects_organisation authorization |
| CVE-2026-6810 | Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover |
| CVE-2026-6965 | Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET... |
| CVE-2026-7144 | 1000 Projects Portfolio Management System MCA update_passwd_process.php authorization |
| CVE-2026-7145 | mettle sendportal Invitation WorkspaceInvitationsController.php destroy authorization |
| CVE-2026-7399 | IDOR in MeWare Software's PDKS |
| CVE-2026-7491 | Zyosoft｜School App - Insecure Direct Object Reference |
| CVE-2026-7502 | LinkStackOrg LinkStack Management Endpoint UserController.php saveLink authorization |
| CVE-2026-7510 | OWAP DefectDojo Benchmark/Engagement/Product/Survey authorization |
| CVE-2026-7573 | GetUserRoles API endpoint allows any authenticated user to enumerate ACL policies across all organizations |
| CVE-2026-7638 | App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification vi... |
| CVE-2026-7648 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to... |
| CVE-2026-7681 | jsbroks COCO Annotator Dataset API datasets.py authorization |
| CVE-2026-7702 | toeverything AFFiNE Public Markdown Preview Endpoint :docId allowDocPreview authorization |
| CVE-2026-7782 | CodeCanyon Perfex CRM Tenant Clients.php project authorization |
| CVE-2026-7881 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in the Express Entry Detail block |
| CVE-2026-7886 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter |
| CVE-2026-8027 | FlowiseAI Flowise User Controller authorization |
| CVE-2026-8196 | JeecgBoot mLogin Endpoint LoginController.java authorization |
| CVE-2026-8204 | Concrete CMS 9.5.0 and below is vulnerable to Authorization Bypass in the Calendar Event Frontend Dialog |
| CVE-2026-8337 | Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private su... |
| CVE-2026-8347 | Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog |
| CVE-2026-8629 | Crabbox < v0.12.0 Privilege Escalation via Agent Ticket Endpoints |
| CVE-2026-8679 | AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter |
| CVE-2026-8786 | Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization |
| CVE-2026-9087 | Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login |
| CVE-2026-9136 | Unauthorized ShadowAttribute modification in MISP via client-supplied identifier |
| CVE-2026-9152 | Unauthenticated SOAP Endpoint in Altium 365 SearchService Allows Cross-Tenant Data Exfiltration and Index Destruction |
| CVE-2026-9248 | Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to... |
| CVE-2026-9306 | QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization |
| CVE-2026-24901 | Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts |
| CVE-2026-24950 | WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-24991 | WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25005 | WordPress Frontend File Manager plugin <= 23.5 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-25120 | Gogs Allows Cross-Repository Comment Deletion via DeleteComment |
| CVE-2026-25654 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user a... |
| CVE-2026-25744 | OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals |
| CVE-2026-25745 | OpenEMR's Message Update Ignores Patient id |
| CVE-2026-2697 | Indirect Object Reference (IDOR) in Security Center |
| CVE-2026-2698 | Improper Access Control |
| CVE-2026-2729 | Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe Pay... |
| CVE-2026-27329 | WordPress YITH WooCommerce Wishlist plugin <= 4.12.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-27591 | Winter: Privilege escalation by authenticated backend users |
| CVE-2026-27898 | Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher |
| CVE-2026-27943 | OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership |
| CVE-2026-28444 | Typebot: IDOR in Result Logs Endpoint Allows Cross-Workspace Data Disclosure |
| CVE-2026-28469 | OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity |
| CVE-2026-28503 | Tandoor Recipes has Cross-Space IDOR in SyncViewSet.query_synced_folder: missing space scoping on get_object_or_404 |
| CVE-2026-28788 | Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite |
| CVE-2026-2879 | GetGenie <= 4.3.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Post Overwrite/Deletion |
| CVE-2026-2888 | Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter |
| CVE-2026-29002 | CouchCMS Privilege Escalation via f_k_levels_list Parameter |
| CVE-2026-29069 | Craft has an unauthenticated activation email trigger with potential user enumeration |
| CVE-2026-29071 | Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories |
| CVE-2026-2917 | Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Duplication via... |
| CVE-2026-2918 | Happy Addons for Elementor <= 3.21.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Stored Cross-Site Scr... |
| CVE-2026-29189 | SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints |
| CVE-2026-29200 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. T... |
| CVE-2026-29204 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another us... |
| CVE-2026-31956 | Xibo CMS has Preview and SavedReport IDOR via disableUserCheck without controller-level authorization |
| CVE-2026-32300 | Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information |
| CVE-2026-32638 | StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens |
| CVE-2026-32694 | Insecure Direct Object Reference attack via predictable secret ID in Juju |
| CVE-2026-32697 | SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR) |
| CVE-2026-32894 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Deletion of Any Student's Grade Result |
| CVE-2026-32930 | Chamilo LMS has an IDOR in Gradebook Allows Cross-Course Evaluation Edit Without Ownership Check |
| CVE-2026-32976 | OpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands |
| CVE-2026-3321 | Authorization Bypass in ON24 Q&A chat |
| CVE-2026-33297 | AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php |
| CVE-2026-33304 | OpenEMR has Authorization Bypass in Dated Reminders Log |
| CVE-2026-33313 | Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments |
| CVE-2026-33345 | solidtime vulnerable to IDOR in private projects |
| CVE-2026-33356 | Meari MQTT broker missing per-device subscribe ACL |
| CVE-2026-33425 | Discourse has inferable private group membership or existence via exclude_groups parameter |
| CVE-2026-34046 | Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check |
| CVE-2026-34055 | OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification |
| CVE-2026-34213 | Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation |
| CVE-2026-3473 | Improper file ownership validation in the Boards API allows unauthorised file access |
| CVE-2026-35430 | Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability |
| CVE-2026-35478 | InvenTree has Arbitrary API Token Creation |
| CVE-2026-35489 | Tandoor Recipes — `amount`/`unit` bypass serializer in `food/{id}/shopping/` |
| CVE-2026-39510 | WordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39526 | WordPress WpStream plugin < 4.11.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-39616 | WordPress Download Attachments plugin <= 1.4.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40589 | FreeScout has Customer Edit Cross-Mailbox Email Takeover |
| CVE-2026-40590 | FreeScout's Customer AJAX Create Modifies Hidden Existing Customer |
| CVE-2026-40591 | FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hidden Customer Modification |
| CVE-2026-40600 | Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id |
| CVE-2026-40737 | WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40784 | WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-40865 | Horilla: Insecure Direct Object Reference at `/employee/view-file/<int:id> |
| CVE-2026-40866 | Horilla: Unauthorized Document Overwrite via File Upload Endpoint |
| CVE-2026-40867 | Horilla: Unauthorized Helpdesk Attachment Access via Attachment ID Manipulation |
| CVE-2026-4208 | Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email) |
| CVE-2026-42097 | Authentication Bypass in Sparx Pro Cloud Server |
| CVE-2026-42889 | Relay Server WebSocket authentication bypass when token is omitted |
| CVE-2026-4330 | Blog2Social: Social Media Auto Post & Scheduler <= 8.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Ar... |
| CVE-2026-44570 | Open WebUI: Inconsistent authorization controls within memories API |
| CVE-2026-44678 | Tuist: IDOR in preview deletion API allows cross-tenant deletion of any preview by UUID |
| CVE-2026-44718 | Mathesar: Missing collaborator checks allowed access to saved explorations in other databases |
| CVE-2026-30886 | New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check |
| CVE-2026-30920 | OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding |
| CVE-2026-30927 | Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter |
| CVE-2026-30944 | StudioCMS Affected by Privilege Escalation via Insecure API Token Generation |
| CVE-2026-30945 | StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service |
| CVE-2026-30954 | LinkAce has a Cross-User Tag/List Attachment IDOR in processTaxonomy() |
| CVE-2026-30959 | OneUptime has WhatsApp Resend Verification Authorization Bypass |
| CVE-2026-30969 | Coral Server has insufficient agent authentication in session communication channels |
| CVE-2026-32131 | ZITADEL Cross-Tenant Information Disclosure in Management API |
| CVE-2026-32533 | WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-32535 | WordPress JS Help Desk plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-32589 | Mirror-registry: quay: insecure direct object reference in blobupload |
| CVE-2026-32761 | File Browser has an Authorization Policy Bypass in its Public Share Download Flow |
| CVE-2026-32867 | OPEXUS eComplaint unauthenticated file upload |
| CVE-2026-33030 | Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys |
| CVE-2026-33052 | MantisBT: Authorization Bypass in Global Profile Creation |
| CVE-2026-33053 | Langflow has Missing Ownership Verification in API Key Deletion (IDOR) |
| CVE-2026-3306 | Improper authorization in GitHub Projects allows modification of issue and pull request metadata without repository write acc... |
| CVE-2026-3307 | Authorization bypass in GitHub Enterprise Server secret scanning push protection allows cross-repository modification of dele... |
| CVE-2026-33141 | Chamilo LMS has an IDOR in REST API Stats Endpoint Exposes Any User's Learning Data |
| CVE-2026-33158 | Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR) |
| CVE-2026-33160 | Craft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL |
| CVE-2026-33484 | Langflow has Unauthenticated IDOR on Image Downloads |
| CVE-2026-33511 | pyload-ng: Authentication Bypass via Host Header Injection in ClickNLoad |
| CVE-2026-33759 | AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents |
| CVE-2026-33764 | AVideo: IDOR in AI Plugin Allows Stealing Other Users' AI-Generated Metadata and Transcriptions |
| CVE-2026-33931 | OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access |
| CVE-2026-33934 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures |
| CVE-2026-33946 | MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay |
| CVE-2026-34370 | Chamilo LMS: IDOR in the Notebook Module allows an attacker to view other users' private notes |
| CVE-2026-34444 | Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr |
| CVE-2026-3453 | ProfilePress <= 4.16.11 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation... |
| CVE-2026-3454 | GenerateBlocks <= 2.2.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via... |
| CVE-2026-34584 | listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) |
| CVE-2026-34602 | Chamilo LMS: IDOR in /api/course_rel_users Allows Unauthorized Enrollment of Arbitrary Users into Courses |
| CVE-2026-34832 | Scoold: Cross-Account Feedback Deletion (IDOR) |
| CVE-2026-34985 | LORIS has incorrect access checks in media module |
| CVE-2026-35023 | Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php |
| CVE-2026-35045 | Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification |
| CVE-2026-35165 | LORIS has incorrect access checks in document_repository |
| CVE-2026-35173 | Chyrp Lite has an IDOR via Mass Assignment in Post Model |
| CVE-2026-35183 | Brave CMS has an Insecure Direct Object Reference in Article Image Deletion |
| CVE-2026-37978 | Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api |
| CVE-2026-39942 | Directus has a Path Traversal and Broken Access Control in File Management API |
| CVE-2026-39967 | TypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter |
| CVE-2026-39968 | TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint |
| CVE-2026-3999 | Broken access control vulnerability affecting ID Server |
| CVE-2026-40043 | Pachno 1.0.6 Authentication Bypass via runSwitchUser() |
| CVE-2026-40127 | Authorization Bypass Through User-Controlled Key in OutSystems Lifetime |
| CVE-2026-40480 | ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` |
| CVE-2026-40570 | FreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII |
| CVE-2026-40896 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup |
| CVE-2026-40907 | WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens |
| CVE-2026-40981 | When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config... |
| CVE-2026-41127 | BigBlueButton's missing authorization allows viewer to inject/overwrite captions |
| CVE-2026-41372 | OpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery |
| CVE-2026-41649 | Outline has IDOR in document share creation that allows unauthorized access to private documents across workspaces |
| CVE-2026-4171 | CodeGenieApp serverless-express API Endpoint TodoList.ts authorization |
| CVE-2026-41906 | FreeScout: Conversation Change-Customer Cross-Mailbox Authorization Bypass |
| CVE-2026-41947 | Dify v1.14.1 Authorization Bypass via Trace Configuration Endpoints |
| CVE-2026-41949 | Dify v1.14.1 Authorization Bypass via File Preview Endpoint |
| CVE-2026-41950 | Dify < 1.14.0 Authorization Bypass via File UUID |
| CVE-2026-42291 | SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional |
| CVE-2026-42456 | AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR) |
| CVE-2026-42463 | SQLBot: Unauthorized Access Vulnerability |
| CVE-2026-42515 | Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS |
| CVE-2026-42516 | Broken Access Control Vulnerability in e-Sushrut HMIS |
| CVE-2026-42517 | Cryptographic Failure Vulnerability in e-Sushrut HMIS |
| CVE-2026-42572 | Hatchet: Cross-tenant information disclosure in `listTasksByDAGIds` |
| CVE-2026-42609 | Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic |
НКЦКИ уязвимости
Бюллетени НКЦКИ - уязвимости ПО
| Идентификатор | Дата бюллетеня | Описание |
|---|---|---|
| VULN:20231222-28 | 22.12.2023 | Обход безопасности в ETL3100 |
| VULN:20240110-7 | 10.01.2024 | Обход безопасности в SIMATIC CN 4100 |
| VULN:20240325-20 | 25.03.2024 | Получение конфиденциальной информации в FortiOS |
| VULN:20240916-18 | 16.09.2024 | Обход безопасности в Siemens Industrial Edge Management |
| VULN:20260610-28 | 10.06.2026 | Внедрение кода в Gitlab |
| VULN:20260610-67 | 10.06.2026 | Получение конфиденциальной информации в moodle-mod_customcert |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.