CWE-639

Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).

Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Ed

Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects Wo

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.

HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vul

The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax

A security defect was identified in Foundry Comments that enabled a user to discover the contents of an attachment submi

Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Prote

Authorization bypass vulnerability in UPV PEIX, affecting the component "pdf_curri_new.php". Through a POST request, an

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization chec

The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization chec

Catalis (previously Icon Software) CMS360 allows a remote, unauthenticated attacker to view sensitive court documents by

Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This

Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries

Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository

Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is som

Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functi

Authenticated users were able to enumerate other users' names via the learning plans page.

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting fr

The Blocksy Companion WordPress plugin before 1.8.82 does not ensure that posts to be accessed via a shortcode are alrea

Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name'

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_payment_sta

A security defect was discovered in Foundry job-tracker that enabled users to query metadata related to builds on resour

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name'

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7

An authorization bypass through user-controlled key [CWE-639] vulnerability in Fortinet FortiManager version 7.4.0 and b

The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prio

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Insecure Direct Object Reference in

Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through

Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue aff

MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11

An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-bet

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with N

The OData service of the S4 HANA (Manage checkbook apps) - versions 102, 103, 104, 105, 106, 107, allows an attacker to

Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects C

TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can uploa

An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/u

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client a

Doctor's Appointment System1.0 is vulnerable to Incorrect Access Control via edoc/patient/settings.php. The settings.php

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass v

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.

LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determi