CVE-2025-1031

IDOR in Utarit Informatics' SoliClub

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse. This issue affects SoliClub: from 5.2.4 before 5.3.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Utarit

Products

Soliclub

CVE-2025-1469

IDOR in Turtek Software's Eyotek

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 11.03.2025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-2301

IDOR in Akbim Software's Online Exam Registration

Authorization Bypass Through User-Controlled Key vulnerability in Akbim Software Online Exam Registration allows Exploitation of Trusted Identifiers. This issue affects Online Exam Registration: before 14.03.2025.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-11369

IDOR in Comment API Allows Cross-Process Comment Read and Write

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linqi

Products

Linqi

CVE-2025-4040

IDOR in Turpak's Automatic Station Monitoring System

Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects Automatic Station Monitoring System: before 5.0.6.51.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-4129

IDOR in PAVO Inc.'s PAVO Pay

Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: before 13.05.2025.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5261

IDOR in PozitifIK's Pik Online

Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers. This issue affects Pik Online: before 3.1.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-5518

IDOR in ArgusTech's BILGER

Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers. This issue affects BILGER: before 2.4.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Argustech

Products

Bilger

CVE-2025-5681

IDOR in Turtek Software's Eyotek

Authorization Bypass Through User-Controlled Key vulnerability in Turtek Software Eyotek allows Exploitation of Trusted Identifiers. This issue affects Eyotek: before 23.06.2025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-7013

IDOR in QRMenumPro's Menu Panel

Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This issue affects Menu Panel: through 29012026.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Qr Menu Pro Smart Menu Systems Qrmenumpro

Products

Menu Panel Menu Panel

CVE-2025-7347

IDOR in Dinibh Puzzle's Dinibh Patrol Tracking System

Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers. This issue affects Dinibh Patrol Tracking System: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Dinibh Puzzle Software Solutions

Products

Dinibh Patrol Tracking System

CVE-2025-7355

IDOR in Beefull Energy Technologies' Beefull App

Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This issue affects Beefull App: before 24.07.2025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Beefull Energy

Products

Beefull App

CVE-2025-8057

IDOR in Patika Global Technologies' HumanSuite

Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Patika Global Technologies HumanSuite allows Exploiting Trust in Client. This issue affects HumanSuite: before 53.21.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Patika Global Technologies

Products

Humansuite

CVE-2025-8463

IDOR in SecHard Information Technologies' SecHard

Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHard: before 3.6.2-20250805.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-8532

IDOR in Bimser's eBA Document and Workflow Management System

Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows Forceful Browsing. This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Bimser

Products

Eba Document And Workflow Management System

CVE-2025-8855

2FA Expiry Bypass in Optimus Software's Brokerage Automation

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information. This issue affects Brokerage Automation: before 1.1.71.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Optimus Software

Products

Brokerage Automation

CVE-2025-8884

IDOR in VHS Electronic Software's ACE Center

Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers. This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vhs Electronic Software

Products

Ace Center

CVE-2025-8887

IDOR in Usta Information Systems' Aybs Interaktif

Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Information Systems Inc. Aybs Interaktif allows Forceful Browsing, Parameter Injection, Input Data Manipulation. This issue affects Aybs Interaktif: from 2024 through 28082025.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Usta

Products

Aybs

CVE-2025-9062

IDOR in MeCODE Informatics' Envanty

Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This issue affects Envanty: before 1.0.6.   NOTE: The vendor was contacted early about this disclosure but did not respond in any way. The vulnerability was learned to be remediated through reporter information and testing.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mecode Informatics And Engineering Services

Products

Envanty

CVE-2025-9342

IDOR in Anadolu Hayat Emeklilik's AHE Mobile

Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobile: from 1.9.7 before 1.9.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—