CWE-639

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_last_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive…

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message…

Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-purchased course contents (quiz / test) via a modified id parameter.

An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possible for attackers (logged in users) to view profile page of other users, as demonstrated by navigating to user/3 on demo.gleezcms.org.

In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).

GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab…

In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of another user, as demonstrated by Name, Email, Identifier, and Description.

In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of another user.

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of another user.