Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,671

Export CSV
CVE-2026-111607

Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jeequan
Products
Jeepay
CVE-2026-111621

TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tduckcloud
Products
Tduck-survey-form
CVE-2026-111351

metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Metasfresh
Products
Metasfresh
CVE-2026-111363

BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox

BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Dataelement
Products
Bisheng
CVE-2026-110764

AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable time-ordered Snowflake file IDs, since FileMapper.getFile performs no owner or tenant check, to retrieve S3-stored files uploaded by other tenants.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Astron-rpa
CVE-2026-110465

WisdomGarden｜Tronclass - Insecure Direct Object Reference

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wisdomgarden
Products
Tronclass
CVE-2026-110467

WisdomGarden｜Tronclass - Insecure Direct Object Reference

Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wisdomgarden
Products
Tronclass
CVE-2024-34323

Insecure Direct Object Reference in ProPhoenix Law RMS Allows Sensitive Data Exposure

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108066

WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR

The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside their own site, including accounts they are not permitted to edit. On single-site installs an administrator can already manage all users, so this crosses a trust boundary only on Multisite.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp 2fa
CVE-2026-103366

Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reload_booking_form_summary_panel` and `steps__start` public routes (reachable through wp_ajax_nopriv_latepoint_route_call). This is due to `OsStepsHelper::set_required_objects()` feeding raw request parameters into `set_booking_object()` and `set_cart_object()`, which call `OsModel::set_data()` and load an arbitrary booking or cart row by primary key with no ownership check — the ownership guard the vendor added for the earlier disclosure lives only inside `OsStepsHelper::load_step()` and does not cover the sibling routes or `cart[id]` at all. This makes it possible for unauthenticated attackers to enumerate sequential booking / cart identifiers and read other customers' appointment details (service name, agent, date/time, duration, price breakdown, status) and other shoppers' pending checkout contents directly from the JSON responses.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Latepoint Wordpress-extensions
Products
Appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress Appointment Booking Plugin
CVE-2026-102986

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a published project's public DeployBoard.anchor can create FileAsset records in that project and soft-delete existing assets by identifier, allowing cross-workspace file injection, storage abuse, and data loss. The issue is fixed in version 1.4.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Makeplane
Products
Plane
CVE-2026-110226

QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation

QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room type form selector and post foreign hotel IDs to AdminProductsController, creating rooms and inventory under other hotels.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Qloapps
CVE-2026-110118

WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Risesoft-y9
Products
Workflow-engine
CVE-2026-110113

PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint

PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member's sequential numeric address id to overwrite its addressee, telephone and address fields, since ownership by the session user and site is never verified.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Publiccms Sanluan
Products
Publiccms Publiccms
CVE-2026-110106

RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}

RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Dromara
Products
Ruoyi-vue-plus
CVE-2026-102981

Plane: Unauthenticated Workspace Invitation Token Leakage

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Makeplane
Products
Plane
CVE-2026-111611

roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders or read course ids and prices.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Roncoo
Products
Roncoo-education
CVE-2026-109957

EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter

EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Import record referencing a known attachment ID, then call the error export endpoint to copy source rows into a downloadable CSV they own.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-111657

BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint

BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/rmas/{id}/mark_as_shipped endpoint to overwrite courier names and tracking numbers and mark approved returns as shipped.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Beikeshop
Products
Beikeshop
CVE-2026-111647

PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}

PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buyer's receipt id to GET /buyer/trade/receipt/{id} to obtain invoice titles, taxpayer identification numbers, order numbers, member ids and member names.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pickmall
Products
Lilishop