Base de CVEs

CVE-2025-15106 Média · 4.3 CWE-639 27/12/2025

getmaxun Authentication Endpoint auth.ts router.get improper authorization

A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2019-25235 Crítica · 9.8 CWE-639 24/12/2025

Bypass de autenticação no lado do cliente no Smartwares HOME easy

O Smartwares HOME easy 1.0.9 contém uma vulnerabilidade de bypass de autenticação que permite que atacantes não autenticados acessem páginas web administrativas ao desabilitar JavaScript. Atacantes podem navegar até múltiplos endpoints administrativos e contornar a validação do lado do cliente para acessar informações sensíveis do sistema.

CVE-2018-25129 Alta · 7.5 CWE-639 24/12/2025

SOCA Access Control System 180612 Information Disclosure via Multiple Endpoints

SOCA Access Control System 180612 contains multiple insecure direct object reference vulnerabilities that allow attackers to access sensitive user credentials. Attackers can retrieve authenticated and unauthenticated user password hashes and pins through unprotected endpoints like Get_Permissions_From_DB.php and Ac10_ReadSortCard.

CVE-2025-67909 Alta · 7.5 CWE-639 24/12/2025

WordPress Membership For WooCommerce plugin <= 3.0.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Membership For WooCommerce: from n/a through <= 3.0.3.

CVE-2021-47721 Alta · 8.8 CWE-639 23/12/2025

Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation

Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user's account.

CVE-2023-53955 Crítica · 9.8 CWE-639 22/12/2025

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Authorization Bypass via Insecure Object References

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to bypass authorization and access hidden system resources. Attackers can exploit the vulnerability by manipulating user-supplied input to execute privileged functionalities without proper authentication.

CVE-2025-7733 Média · 4.3 CWE-639 20/12/2025

WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'cs_update_application_status_callback' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Candidate-level access and above, to send a site-generated email with injected HTML to any user.

CVE-2025-14882 Baixa · 3.8 CWE-639 19/12/2025

Insecure direct object reference

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

CVE-2025-14881 Baixa · 3.8 CWE-639 19/12/2025

Insecure direct object reference

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

CVE-2025-64282 Média · 4.3 CWE-639 18/12/2025

WordPress Radius Blocks plugin <= 2.2.1 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Blocks: from n/a through <= 2.2.1.

CVE-2025-63043 Média · 5.3 CWE-639 18/12/2025

WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.23 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.23.

CVE-2025-1031 Alta · 7.5 CWE-639 18/12/2025

IDOR in Utarit Informatics' SoliClub

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse. This issue affects SoliClub: from 5.2.4 before 5.3.7.

CVE-2025-13110 Média · 4.3 CWE-639 18/12/2025

HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr'

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.3 via the "woof_add_subscr" function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber level access and above, to create product messenger subscriptions on behalf of arbitrary users, including administrators.

CVE-2025-10910 Crítica · 9.3 CWE-639 18/12/2025

Falha de vinculação na nuvem Govee permite tomada remota de dispositivo (H6056)

Uma falha no processo de vinculação entre a plataforma em nuvem da Govee e os dispositivos permite que um atacante remoto vincule um dispositivo Govee existente e online à conta do atacante, resultando em controle total do dispositivo e na remoção do dispositivo da conta do proprietário legítimo. A API do lado do servidor permite a associação de dispositivos usando um conjunto de identificadores: “device”, “sku”, “type” e um “value” calculado pelo cliente, que não estão criptograficamente vinculados a um segredo originado do próprio dispositivo. A vulnerabilidade foi verificada na lâmpada Govee H6056 com versão de firmware 1.08.13, mas pode afetar também outros dispositivos Govee conectados à nuvem. O fabricante está investigando outros modelos potencialmente afetados. O fabricante implantou melhorias de segurança do lado do servidor e atualizações automáticas de firmware para o modelo H6056. A maioria dos dispositivos H6056 foi corrigida com sucesso por meio de atualizações automáticas. Usuários remanescentes do H6056 com versões de hardware atualizáveis devem atualizar o firmware manualmente pelo aplicativo Govee Home, mantendo o dispositivo conectado ao Wi-Fi. Os usuários devem abrir o aplicativo Govee Home, tocar no cartão do dispositivo H6056 para acessar a página de detalhes, tocar no ícone de configurações no canto superior direito, acessar a seção Informações do Dispositivo (Versão do Firmware) e tocar em Atualizar para instalar o patch de segurança imediatamente. Dispositivos Govee H6056 com versões de hardware 1.00.10 ou 1.00.11 não podem receber atualização de firmware devido a limitações de hardware.

CVE-2025-10019 Média · 6.5 CWE-639 18/12/2025

WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.

CVE-2023-53930 Alta · 7.5 CWE-639 17/12/2025

ProjectSend r1605 Insecure Direct Object Reference File Download Vulnerability

ProjectSend r1605 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to download private files by manipulating the download ID parameter. Attackers can access any user's private files by changing the 'id' parameter in the download request to process.php.

CVE-2023-53914 Crítica · 9.8 CWE-639 17/12/2025

UliCMS 2023.1 Authentication Bypass via Mass Assignment Vulnerability

UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.

CVE-2025-34438 Alta · 8.1 CWE-639 17/12/2025

AVideo < 20.1 IDOR Arbitrary Video Rotation

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

CVE-2025-34437 Alta · 8.8 CWE-639 17/12/2025

AVideo < 20.1 IDOR Arbitrary Comment Image Upload

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.

CVE-2025-34436 Alta · 8.8 CWE-639 17/12/2025

AVideo < 20.1 IDOR Arbitrary File Upload

AVideo versions prior to 20.1 allow any authenticated user to upload files into directories belonging to other users due to an insecure direct object reference. The upload functionality verifies authentication but does not enforce ownership checks.

CVE-2025-34435 Média · 6.5 CWE-639 17/12/2025

AVideo < 20.1 IDOR Arbitrary File Deletion

AVideo versions prior to 20.1 are vulnerable to an insecure direct object reference (IDOR) that allows any authenticated user to delete media files belonging to other users. The affected endpoint validates authentication but fails to verify ownership or edit permissions for the targeted video.

CVE-2025-67165 Crítica · 9.8 CWE-639 17/12/2025

Authorization Bypass Through User-Controlled Key (IDOR) em Pagekit

An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.

CVE-2025-14101 Alta · 7.1 CWE-639 17/12/2025

IDOR in GG Soft's PaperWork

Authorization Bypass Through User-Controlled Key vulnerability in GG Soft Software Services Inc. PaperWork allows Exploitation of Trusted Identifiers. This issue affects PaperWork: from 5.2.0.9427 before 6.0.

CVE-2025-11924 Alta · 7.5 CWE-639 17/12/2025

Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.

CVE-2025-64012 Média · 4.3 CWE-639 16/12/2025

Authorization Bypass Through User-Controlled Key (IDOR) em Invoiceplane

InvoicePlane commit debb446c is vulnerable to Incorrect Access Control. The invoices/view handler fails to verify ownership before returning invoice data.