CWE-639 · Authorization Bypass Through User-Controlled Key (page 19)
Page 19 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10570 | Medium | 4.3 | 2025-10-22 | The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 v… |
CVE-2025-60511 | Medium | 4.3 | 2025-10-21 | Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the… |
CVE-2025-8884 | Medium | 5.5 | 2025-10-20 | Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted I… |
CVE-2025-11741 | Medium | 5.3 | 2025-10-18 | The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.2.5 via the 'woosq_… |
CVE-2025-11519 | Medium | 4.3 | 2025-10-18 | The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-11517 | High | 7.5 | 2025-10-18 | The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-js… |
CVE-2025-11895 | Medium | 4.3 | 2025-10-17 | The Binary MLM Plan plugin for WordPress is vulnerable to insecure direct object reference in versions up to, and including, 5.0. This is due to the bmp_user_p… |
CVE-2025-9559 | Medium | 6.5 | 2025-10-16 | Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to… |
CVE-2024-56143 | High | 8.2 | 2025-10-16 | Strapi is an open-source headless content management system. In versions from 5.0.0 to before 5.5.2, the lookup operator provided by the document service does… |
CVE-2025-41020 | High | 7.5 | 2025-10-16 | Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other custom… |
CVE-2025-10742 | Critical | 9.8 | 2025-10-16 | The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin pro… |
CVE-2025-11176 | Medium | 4.3 | 2025-10-15 | The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfi_set_t… |
CVE-2025-40773 | Low | 3.5 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications contains a broken access control vulnerability. Th… |
CVE-2025-62252 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 thro… |
CVE-2025-62242 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 202… |
CVE-2025-62241 | Medium | 4.3 | 2025-10-13 | Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote authenticated users to f… |
CVE-2025-62244 | Medium | 4.3 | 2025-10-13 | Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2… |
CVE-2025-9902 | High | 7.5 | 2025-10-13 | Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abus… |
CVE-2025-31997 | Medium | 4.2 | 2025-10-12 | HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in… |
CVE-2025-11518 | Medium | 5.3 | 2025-10-11 | The WPC Smart Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via s… |
CVE-2025-8887 | Medium | 6.1 | 2025-10-10 | Authorization Bypass Through User-Controlled Key, Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Usta Infor… |
CVE-2025-61779 | | 2025-10-09 | Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0… | |
CVE-2025-6038 | High | 8.8 | 2025-10-09 | The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password up… |
CVE-2025-43724 | Medium | 4.4 | 2025-10-08 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. A high privileged attacker with… |
CVE-2025-40676 | | 2025-10-07 | Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This… | |
CVE-2025-0606 | Medium | 6.0 | 2025-10-06 | Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue a… |
CVE-2025-11321 | Medium | 4.3 | 2025-10-06 | A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/educat… |
CVE-2025-0642 | Medium | 6.3 | 2025-10-02 | Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allow… |
CVE-2025-58055 | Medium | 4.3 | 2025-10-01 | Discourse is an open-source community discussion platform. In versions 3.5.0 and below, the Discourse AI suggestion endpoints for topic “Title”, “Category”, an… |
CVE-2025-59687 | Medium | 4.3 | 2025-10-01 | IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arb… |
CVE-2025-56392 | High | 8.1 | 2025-09-30 | An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attackers to impersonate other users and perf… |
CVE-2025-43827 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay… |
CVE-2025-41099 | Medium | 6.5 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41098 | High | 7.5 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a misuse of the general enq… |
CVE-2025-41097 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41096 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41095 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41094 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41093 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41092 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-41091 | Medium | 4.3 | 2025-09-30 | Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validatio… |
CVE-2025-55795 | Low | 3.5 | 2025-09-29 | The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflo… |
CVE-2025-10947 | Medium | 5.3 | 2025-09-25 | A flaw has been found in Sistemas Pleno Gestão de Locação up to 2025.7.x. The impacted element is an unknown function of the file /api/areacliente/pessoa/valid… |
CVE-2025-9342 | Medium | 6.5 | 2025-09-23 | Authorization Bypass Through User-Controlled Key vulnerability in Anadolu Hayat Emeklilik Inc. AHE Mobile allows Privilege Abuse. This issue affects AHE Mobil… |
CVE-2025-7106 | Medium | 5.3 | 2025-09-23 | danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/mid… |
CVE-2025-43810 | Medium | 4.3 | 2025-09-22 | Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 20… |
CVE-2025-59562 | Medium | 5.5 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-58012 | Low | 3.8 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-57994 | Medium | 5.4 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Sayful Islam Upcoming Events Lists upcoming-events-lists allows Exploiting Incorrectly Config… |
CVE-2025-0875 | Medium | 6.5 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in PROLIZ Computer Software Hardware Service Trade Ltd. Co. OBS (Student Affairs Information Sys… |
CVE-2025-10759 | Medium | 5.3 | 2025-09-21 | A vulnerability was detected in Webkul QloApps up to 1.7.0. This affects an unknown function of the component CSRF Token Handler. Performing manipulation of th… |
CVE-2025-9081 | Low | 3.1 | 2025-09-19 | Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive fil… |
CVE-2025-43803 | Medium | 4.3 | 2025-09-19 | Insecure direct object reference (IDOR) vulnerability in the Contacts Center widget in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions… |
CVE-2025-8532 | Medium | 6.4 | 2025-09-19 | Authorization Bypass Through User-Controlled Key, Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Managem… |
CVE-2025-10719 | Medium | 4.3 | 2025-09-19 | Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers with regular privilege to modify a specifi… |
CVE-2025-5948 | Critical | 9.8 | 2025-09-19 | The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is… |
CVE-2025-10493 | Medium | 5.3 | 2025-09-18 | The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mecha… |
CVE-2025-8463 | Medium | 5.3 | 2025-09-17 | Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This issue affects SecHar… |
CVE-2025-8057 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key, Externally Controlled Reference to a Resource in Another Sphere, Improper Authorization vulnerability in Pati… |
CVE-2025-7355 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key vulnerability in Beefull Energy Technologies Beefull App allows Exploitation of Trusted Identifiers. This iss… |
CVE-2025-5518 | Medium | 6.5 | 2025-09-16 | Authorization Bypass Through User-Controlled Key vulnerability with user privileges in ArgusTech BILGER allows Exploitation of Trusted Identifiers. This issue… |
CVE-2025-43790 | High | 8.1 | 2025-09-11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through… |
CVE-2025-43782 | Medium | 4.3 | 2025-09-11 | Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7, 2024.Q1.1 through… |
CVE-2025-59034 | Medium | 4.3 | 2025-09-10 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrie… |
CVE-2025-7718 | High | 8.8 | 2025-09-10 | The Resideo Plugin for Resideo - Real Estate WordPress Theme plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up… |
CVE-2025-7049 | High | 8.8 | 2025-09-10 | The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 67.7.0 via the 'MJ… |
CVE-2025-52389 | High | 8.8 | 2025-09-08 | An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensitive data for other u… |
CVE-2025-9114 | Critical | 9.8 | 2025-09-08 | The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing us… |
CVE-2025-58597 | Medium | 4.3 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2024-13063 | Medium | 6.8 | 2025-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft MyRezzta allows Forceful Browsing. This issue affects MyRezzta: from s2.02.02 befor… |
CVE-2025-22422 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another du… |
CVE-2025-9836 | Medium | 4.3 | 2025-09-02 | A vulnerability was found in macrozheng mall up to 1.0.3. This vulnerability affects the function paySuccess of the file /order/paySuccess. The manipulation of… |
CVE-2025-9835 | Medium | 4.3 | 2025-09-02 | A vulnerability has been found in macrozheng mall up to 1.0.3. This affects the function cancelOrder of the file /order/cancelUserOrder. The manipulation of th… |
CVE-2025-0670 | Medium | 4.7 | 2025-09-02 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft ProKuafor allows Resource Leak Exposure. This issue affects ProKuafor: from s1.02.0… |
CVE-2025-56254 | Medium | 4.3 | 2025-09-02 | PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference (IDOR) vulnerability in leave-details.php. An authenticated user c… |
CVE-2025-0640 | Medium | 4.7 | 2025-09-02 | Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft OctoCloud allows Resource Leak Exposure. This issue affects OctoCloud: from s1.09.0… |
CVE-2025-8447 | Low | 3.1 | 2025-08-26 | An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code c… |
CVE-2025-45968 | Critical | 9.8 | 2025-08-25 | An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. The application contains an Insecure Dire… |
CVE-2025-55621 | Medium | 6.5 | 2025-08-22 | An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profil… |
CVE-2025-57886 | Medium | 5.4 | 2025-08-22 | Authorization Bypass Through User-Controlled Key vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Explo… |
CVE-2025-55370 | High | 8.8 | 2025-08-21 | Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the corresponding ID d… |
CVE-2025-9264 | Medium | 5.4 | 2025-08-21 | A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller… |
CVE-2025-9263 | Medium | 4.3 | 2025-08-20 | A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl… |
CVE-2025-5261 | High | 7.5 | 2025-08-20 | Authorization Bypass Through User-Controlled Key vulnerability in Pik Online Yazılım Çözümleri A.Ş. Pik Online allows Exploitation of Trusted Identifiers. Thi… |
CVE-2025-53208 | High | 7.5 | 2025-08-20 | Authorization Bypass Through User-Controlled Key vulnerability in paymayapg Maya Business paymaya-checkout-for-woocommerce allows Accessing Functionality Not P… |
CVE-2025-55737 | Medium | 6.5 | 2025-08-19 | flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can… |
CVE-2025-43732 | Low | 2.7 | 2025-08-18 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 thro… |
CVE-2025-54691 | Medium | 5.3 | 2025-08-14 | Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Confi… |
CVE-2025-8770 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allo… |
CVE-2025-3089 | | 2025-08-12 | ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileg… | |
CVE-2025-8794 | Medium | 5.3 | 2025-08-10 | A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0. Affected by this issue is some unknown functionality o… |
CVE-2025-8789 | Medium | 4.3 | 2025-08-10 | A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diari… |
CVE-2025-8755 | Medium | 5.3 | 2025-08-09 | A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController… |
CVE-2025-4796 | High | 8.8 | 2025-08-08 | The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the pl… |
CVE-2025-36023 | Medium | 6.5 | 2025-08-08 | IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and… |
CVE-2025-51533 | Medium | 5.3 | 2025-08-07 | An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET… |
CVE-2025-46387 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-46386 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-51628 | High | 7.5 | 2025-08-05 | Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthenticated attackers to… |
CVE-2025-50340 | Medium | 4.3 | 2025-08-04 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of… |