{
  "affected": [],
  "aliases": [
    "CVE-2024-5942"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-29T05:15:03Z",
    "severity": "MODERATE"
  },
  "details": "The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the \u0027content_clone\u0027 function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.",
  "id": "GHSA-r688-p362-j7qj",
  "modified": "2024-06-29T06:31:41Z",
  "published": "2024-06-29T06:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5942"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/page-or-post-clone/trunk/page-or-post-clone.php#L19"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3108149"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0931f279-2dac-4663-9344-df27b43a7e64?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-10779"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-09T03:15:05Z",
    "severity": "MODERATE"
  },
  "details": "The Cowidgets \u2013 Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the \u0027ce_template\u0027 shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.",
  "id": "GHSA-r6x6-p549-4h98",
  "modified": "2025-01-29T21:31:23Z",
  "published": "2024-11-09T03:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10779"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/cowidgets-elementor-addons"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ec005f9f-3f63-4d73-9bd5-dc9c4c4b8bfe?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-32669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-03T13:15:10Z",
    "severity": "MODERATE"
  },
  "details": "Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users\u0027 albums. This vulnerability can be exploited by changing the album identification (id).",
  "id": "GHSA-r73q-v29w-vr75",
  "modified": "2024-04-04T08:08:20Z",
  "published": "2023-10-03T15:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32669"
    },
    {
      "type": "WEB",
      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-budyboss"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-4836"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-31T14:15:12Z",
    "severity": "MODERATE"
  },
  "details": "The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced",
  "id": "GHSA-r75f-cj9v-2727",
  "modified": "2023-11-08T21:30:34Z",
  "published": "2023-10-31T15:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4836"
    },
    {
      "type": "WEB",
      "url": "https://research.cleantalk.org/cve-2023-4836-user-private-files-idor-to-sensitive-data-and-private-files-exposure-leak-of-info-poc"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/c17f2534-d791-4fe3-b45b-875777585dc6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31941"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-15T21:16:04Z",
    "severity": "MODERATE"
  },
  "details": "An unauthenticated attacker can obtain a list of smart devices by knowing a valid username.",
  "id": "GHSA-r77w-c9p5-cw2v",
  "modified": "2025-04-15T21:31:49Z",
  "published": "2025-04-15T21:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31941"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-66132"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T09:15:57Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in FAPI Business s.r.o. FAPI Member fapi-member allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAPI Member: from n/a through \u003c= 2.2.26.",
  "id": "GHSA-r7gx-7548-6cr2",
  "modified": "2026-01-20T15:32:15Z",
  "published": "2025-12-16T09:31:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66132"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/fapi-member/vulnerability/wordpress-fapi-member-plugin-2-2-26-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://vdp.patchstack.com/database/Wordpress/Plugin/fapi-member/vulnerability/wordpress-fapi-member-plugin-2-2-26-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-41307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-10-26T05:15:00Z",
    "severity": "HIGH"
  },
  "details": "Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and private filters via an Insecure Direct Object References (IDOR) vulnerability in the Workload Pie Chart Gadget. The affected versions are before version 8.13.12, and from version 8.14.0 before 8.20.0.",
  "id": "GHSA-r7h9-6386-76cq",
  "modified": "2022-05-24T19:18:51Z",
  "published": "2022-05-24T19:18:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41307"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/JRASERVER-72916"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "oauthenticator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31027"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-06T21:21:40Z",
    "nvd_published_at": "2022-06-09T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "# Background\n\nCILogon is a federated auth provider that allows users to authenticate\nthemselves via a number of Identity Providers (IdP), focused primarily on educational and\nresearch institutions (such as Universities). More traditional and open IdPs\nsuch as GitHub, ORCID, Google, Microsoft, etc are also supported.\n\nCILogonOAuthenticator is provided by the OAuthenticator package, and lets users log\nin to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub\nonly to users of a given institute. The allowed_idps configuration trait of\nCILogonOAuthenticator is documented to be a list of domains that indicate the\ninstitutions whose users are authorized to access this JupyterHub. This authorization\nis validated by ensuring that the *email* field provided to us by CILogon has a\n*domain* that matches one of the domains listed in `allowed_idps`.\n\n# Impact\n\nIf `allowed_idps` contains `berkeley.edu`, you might expect only users with valid\ncurrent credentials provided by University of California, Berkeley to be able to\naccess the JupyterHub. However, CILogonOAuthenticator does *not* verify which provider\nis used by the user to login, only the email address provided. So a user can login\nwith a GitHub account that has email set to `\u003csomething\u003e@berkeley.edu`, and that will\nbe treated exactly the same as someone logging in using the UC Berkeley official\nIdentity Provider. This has two consequences:\n\n1. Since GitHub (and most other providers we tested) only require you to verify\n   your email once, a user can access a JupyterHub even if their access to\n   the institution\u0027s IdP has been revoked or expired.\n2. CILogon supports hundreds of identity providers - if even one of them allows\n   users to set any email ids without verifying, that can be used to impersonate\n   *any* user on any other identity provider! While CILogon itself has a stellar\n   security record, this particular method of doing authorization means an attacker\n   would only need to compromise a single identity provider to compromise all of\n   CILogon\n\nWe currently do not know of any identity provider that provides *unverified*\nemail addresses to CILogon, so this is not a severe known vulnerability. However,\nthere are hundreds of IdPs, and we could not try them all.\n\n# Patches\n\nThis patch makes a *breaking change* in how `allowed_idps` is interpreted. It\u0027s\nno longer a list of domains, but configuration representing the `EntityID` of the\nIdPs that are allowed, picked from the [list maintained by CILogon](https://cilogon.org/idplist/).\nSo instead of `berkeley.edu`, you would specify `urn:mace:incommon:berkeley.edu` to\nallow logins from users currently with `berkeley.edu` accounts. GitHub users\nwith a verified `berkeley.edu` email will no longer be allowed to log in.\n\nFor details on how to transition your CILogonOAuthenticator configuration to the patched version 15.0.0 or above, see [the migration](https://oauthenticator.readthedocs.io/en/latest/migrations.html) documentation.",
  "id": "GHSA-r7v4-jwx9-wx43",
  "modified": "2022-06-06T21:21:40Z",
  "published": "2022-06-06T21:21:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-r7v4-jwx9-wx43"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31027"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/commit/5cd2d1816f90dc5c946e6e38fd2d0ba535624c5c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterhub/oauthenticator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthenticator/PYSEC-2022-206.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-3810"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-09T03:15:24Z",
    "severity": "CRITICAL"
  },
  "details": "The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user\u0027s identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s email addresses and passwords, including administrators, and leverage that to gain access to their account.",
  "id": "GHSA-r7x3-qhq3-x8hr",
  "modified": "2025-05-09T03:30:25Z",
  "published": "2025-05-09T03:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3810"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/54f1ebfb-67f1-461d-91f1-269b0a2c0653?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "agents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-1664"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-03T18:42:01Z",
    "nvd_published_at": "2026-02-03T12:16:11Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn Insecure Direct Object Reference (CWE-639) has been found to exist in createHeaderBasedEmailResolver() function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin checks, allowing an external attacker with control of these headers to route inbound mail to arbitrary Durable Object instances and namespaces.\n\n### Root cause\nThe createHeaderBasedEmailResolver() function lacks cryptographic verification or origin validation for the headers used in the routing logic, effectively allowing external input to dictate internal object routing.\n\n### Impact\nInsecure Direct Object Reference (IDOR) in email routing lets an attacker steer inbound mail to arbitrary Agent instances via spoofed Message-ID.\n\n\n\n### Patches\nAgents-sdk users should  upgrade to agents@0.3.7. \nPR: https://github.com/cloudflare/agents/pull/811\nThis [documentation](https://github.com/cloudflare/agents/blob/main/docs/email.md) provides the necessary architectural context for coding agents to mitigate the issue by refactoring the resolver to enforce strict identity boundaries.",
  "id": "GHSA-r7x9-8ph7-w8cg",
  "modified": "2026-02-03T18:42:01Z",
  "published": "2026-02-03T18:42:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cloudflare/agents/security/advisories/GHSA-r7x9-8ph7-w8cg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1664"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cloudflare/agents"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cloudflare/agents/blob/main/docs/email.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing"
}