CWE-639 · Authorization Bypass Through User-Controlled Key (page 13)
Page 13 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12353 | Medium | 5.3 | 2025-11-08 | The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized… |
CVE-2025-11748 | Medium | 4.3 | 2025-11-08 | The Groups plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0 via the 'group_id' parameter of t… |
CVE-2025-64431 | | 2025-11-07 | Zitadel is an open source identity management platform. Versions 4.0.0-rc.1 through 4.6.2 are vulnerable to secure Direct Object Reference (IDOR) attacks throu… | |
CVE-2025-12854 | Low | 3.7 | 2025-11-07 | A vulnerability was identified in newbee-mall-plus up to 2.4.1. This vulnerability affects the function executeSeckill of the file /seckillExecution/. The mani… |
CVE-2025-58627 | Critical | 9.8 | 2025-11-06 | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Exploiting Incorrectly Configured A… |
CVE-2025-63248 | High | 7.5 | 2025-11-05 | DWSurvey 6.14.0 is vulnerable to Incorrect Access Control. When deleting a questionnaire, replacing the questionnaire ID with the ID of another questionnaire c… |
CVE-2025-11690 | High | 8.5 | 2025-11-04 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other user… |
CVE-2025-0987 | Critical | 9.9 | 2025-11-03 | Authorization Bypass Through User-Controlled Key vulnerability in CB Project Ltd. Co. CVLand allows Parameter Injection. This issue affects CVLand: from 2.1.0… |
CVE-2025-12623 | Low | 3.1 | 2025-11-03 | A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the… |
CVE-2025-6574 | High | 8.8 | 2025-11-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and excluding, 6.1. This is… |
CVE-2025-5949 | High | 8.8 | 2025-11-01 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is… |
CVE-2025-61876 | Medium | 5.0 | 2025-10-29 | Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to… |
CVE-2025-64283 | Medium | 6.5 | 2025-10-29 | Authorization Bypass Through User-Controlled Key vulnerability in Rometheme RTMKit rometheme-for-elementor allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-12351 | Medium | 6.8 | 2025-10-27 | Honeywell S35 Series Cameras contains an authorization bypass Vulnerability through User controller key. An attacker could potentially exploit this vulnerabili… |
CVE-2025-12288 | Medium | 4.3 | 2025-10-27 | A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4. Affected is an unknown function of the file /user/edit_user/ of the component User… |
CVE-2025-12283 | Medium | 4.3 | 2025-10-27 | A security flaw has been discovered in code-projects Client Details System 1.0. The impacted element is an unknown function. The manipulation results in author… |
CVE-2025-12270 | Medium | 4.3 | 2025-10-27 | A vulnerability was determined in LearnHouse up to 98dfad76aad70711a8113f6c1fdabfccf10509ca. The impacted element is an unknown function of the file /api/v1/as… |
CVE-2025-34293 | | 2025-10-24 | GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's o… | |
CVE-2025-11957 | High | 8.4 | 2025-10-22 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or app… |
CVE-2025-49952 | Medium | 6.5 | 2025-10-22 | Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-6833 | Medium | 4.3 | 2025-10-22 | The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver… |
CVE-2025-10570 | Medium | 4.3 | 2025-10-22 | The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 v… |
CVE-2025-60511 | Medium | 4.3 | 2025-10-21 | Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the… |
CVE-2025-8884 | Medium | 5.5 | 2025-10-20 | Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted I… |
CVE-2025-11741 | Medium | 5.3 | 2025-10-18 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_… |
CVE-2025-11519 | Medium | 4.3 | 2025-10-18 | The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-11517 | High | 7.5 | 2025-10-18 | The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-js… |
CVE-2025-11895 | Medium | 4.3 | 2025-10-17 | The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_p… |
CVE-2025-9559 | Medium | 6.5 | 2025-10-16 | Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to… |
CVE-2024-56143 | High | 8.2 | 2025-10-16 | Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does… |
CVE-2025-41020 | High | 7.5 | 2025-10-16 | Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other custom… |
CVE-2025-10742 | Critical | 9.8 | 2025-10-16 | The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin pro… |
CVE-2025-11176 | Medium | 4.3 | 2025-10-15 | The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_t… |
CVE-2025-40773 | Low | 3.5 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. Th… |
CVE-2025-62252 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 thro… |
CVE-2025-62242 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 202… |
CVE-2025-62241 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to f… |
CVE-2025-62244 | Medium | 4.3 | 2025-10-13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2… |
CVE-2025-9902 | High | 7.5 | 2025-10-13 | Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abus… |
CVE-2025-31997 | Medium | 4.2 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in… |
CVE-2025-11518 | Medium | 5.3 | 2025-10-11 | The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via s… |
CVE-2025-8887 | Medium | 6.1 | 2025-10-10 | Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Infor… |
CVE-2025-61779 | | 2025-10-09 | Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0… | |
CVE-2025-6038 | High | 8.8 | 2025-10-09 | The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password up… |
CVE-2025-43724 | Medium | 4.4 | 2025-10-08 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with… |
CVE-2025-40676 | | 2025-10-07 | Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This… | |
CVE-2025-0606 | Medium | 6.0 | 2025-10-06 | Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue a… |
CVE-2025-11321 | Medium | 4.3 | 2025-10-06 | A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/educat… |
CVE-2025-0642 | Medium | 6.3 | 2025-10-02 | Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allow… |
CVE-2025-58055 | Medium | 4.3 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, an… |
CVE-2025-59687 | Medium | 4.3 | 2025-10-01 | IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arb… |
CVE-2025-56392 | High | 8.1 | 2025-09-30 | An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perf… |
CVE-2025-43827 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay… |
CVE-2025-41099 | Medium | 6.5 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41098 | High | 7.5 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a misuse of the general enq… |
CVE-2025-41097 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41096 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41095 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41094 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41093 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41092 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41091 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-55795 | Low | 3.5 | 2025-09-29 | The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflo… |
CVE-2025-10947 | Medium | 5.3 | 2025-09-25 | A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/valid… |
CVE-2025-9342 | Medium | 6.5 | 2025-09-23 | Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobil… |
CVE-2025-7106 | Medium | 5.3 | 2025-09-23 | danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/mid… |
CVE-2025-43810 | Medium | 4.3 | 2025-09-22 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 20… |
CVE-2025-59562 | Medium | 5.5 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-58012 | Low | 3.8 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-57994 | Medium | 5.4 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Sayful Islam Upcoming Events Lists upcoming-events-lists allows Exploiting Incorrectly Config… |
CVE-2025-0875 | Medium | 6.5 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information Sys… |
CVE-2025-10759 | Medium | 5.3 | 2025-09-21 | A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of th… |
CVE-2025-9081 | Low | 3.1 | 2025-09-19 | Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive fil… |
CVE-2025-43803 | Medium | 4.3 | 2025-09-19 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions… |
CVE-2025-8532 | Medium | 6.4 | 2025-09-19 | Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Managem… |
CVE-2025-10719 | Medium | 4.3 | 2025-09-19 | Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specifi… |
CVE-2025-5948 | Critical | 9.8 | 2025-09-19 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is… |
CVE-2025-10493 | Medium | 5.3 | 2025-09-18 | The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mecha… |
CVE-2025-8463 | Medium | 5.3 | 2025-09-17 | Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHar… |
CVE-2025-8057 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Pati… |
CVE-2025-7355 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This iss… |
CVE-2025-5518 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers. This issue… |
CVE-2025-43790 | High | 8.1 | 2025-09-11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through… |
CVE-2025-43782 | Medium | 4.3 | 2025-09-11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through… |
CVE-2025-59034 | Medium | 4.3 | 2025-09-10 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrie… |
CVE-2025-7718 | High | 8.8 | 2025-09-10 | The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up… |
CVE-2025-7049 | High | 8.8 | 2025-09-10 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ… |
CVE-2025-52389 | High | 8.8 | 2025-09-08 | An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensitive data for other u… |
CVE-2025-9114 | Critical | 9.8 | 2025-09-08 | The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing us… |
CVE-2025-58597 | Medium | 4.3 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-13063 | Medium | 6.8 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft MyRezzta allows Forceful Browsing. This issue affects MyRezzta: from s2.02.02 befor… |
CVE-2025-22422 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another du… |
CVE-2025-9836 | Medium | 4.3 | 2025-09-02 | A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of… |
CVE-2025-9835 | Medium | 4.3 | 2025-09-02 | A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of th… |
CVE-2025-0670 | Medium | 4.7 | 2025-09-02 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure. This issue affects ProKuafor: from s1.02.0… |
CVE-2025-56254 | Medium | 4.3 | 2025-09-02 | PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user c… |
CVE-2025-0640 | Medium | 4.7 | 2025-09-02 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure. This issue affects OctoCloud: from s1.09.0… |
CVE-2025-8447 | Low | 3.1 | 2025-08-26 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code c… |
CVE-2025-45968 | Critical | 9.8 | 2025-08-25 | An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Dire… |
CVE-2025-55621 | Medium | 6.5 | 2025-08-22 | An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profil… |