Filtered by CWE-639
Filtered by vendor Subscriptions
Total 991 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-41091 2 Boldworkplanner, Gps 2 Workplanner, Bold Workplanner 2025-10-08 4.3 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised internal identifiers.
CVE-2025-41099 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 6.5 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the list of permissions using unauthorised internal identifiers.
CVE-2025-41098 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 7.5 High
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a  misuse of the general enquiry web service.
CVE-2025-41097 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 4.3 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic employee details using unauthorised internal identifiers.
CVE-2025-41096 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 4.3 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to the dates of the current contract details using unauthorised internal identifiers.
CVE-2025-41095 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 4.3 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unauthorised internal identifiers.
CVE-2025-41094 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 4.3 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to functional contract details using unauthorised internal identifiers.
CVE-2025-41093 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 4.3 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to basic contract details using unauthorised internal identifiers.
CVE-2025-41092 2 Boldworkplanner, Gps 2 Bold Workplanner, Bold Workplanner 2025-10-08 4.3 Medium
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to time records details using unauthorised internal identifiers.
CVE-2025-43724 2025-10-08 4.4 Medium
Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain unauthorized access to NFSv4 or SMB shares.
CVE-2025-40676 1 Bbmri-eric 1 Negotiator 2025-10-08 N/A
Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in '/api/v3/users/<userID>', which may result in the exposure or alteration of sensitive data
CVE-2025-7900 1 Typo3 1 Typo3 2025-10-07 6.5 Medium
The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0
CVE-2025-11321 1 Zhuimengshaonian 1 Wisdom-education 2025-10-06 4.3 Medium
A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used.
CVE-2025-0606 1 Logo Software 1 Logo Cloud 2025-10-06 6 Medium
Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure.This issue affects Logo Cloud: before 0.67.
CVE-2025-0642 1 Poscube 1 Assist 2025-10-03 6.3 Medium
Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allows Excavation, Authentication Bypass.This issue affects Assist: through 10.02.2025.
CVE-2025-56392 1 Collegetivity Project 1 Collegetivity 2025-10-02 8.1 High
An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perform arbitrary operations via a crafted POST request.
CVE-2025-43827 1 Liferay 2 Dxp, Portal 2025-10-02 N/A
Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote authenticated users to from one virtual instance to view the audit events from a different virtual instance via the _com_liferay_portal_security_audit_web_portlet_AuditPortlet_auditEventId parameter.
CVE-2025-58055 1 Discourse 1 Discourse 2025-10-02 4.3 Medium
Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, and “Tags” allowed authenticated users to extract information about topics that they weren’t authorized to access. By modifying the “topic_id” value in API requests to the AI suggestion endpoints, users could target specific restricted topics. The AI model’s responses then disclosed information that the authenticated user couldn’t normally access. This issue is fixed in version 3.5.1. To workaround this issue, users can restrict group access to the AI helper feature through the "composer_ai_helper_allowed_groups" and "post_ai_helper_allowed_groups" site settings.
CVE-2025-55621 1 Reolink 1 Reolink 2025-10-02 6.5 Medium
An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafted URL. NOTE: this is disputed by the Supplier because it is intentional behavior; the photos are part of a social platform on which users expect to find one another.
CVE-2025-51533 2 Sage, Sagedpw 2 Dpw, Sage Dpw 2025-10-01 5.3 Medium
An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET request.