CWE-566 · Insecure Direct Object Reference
Authorization Bypass Through User-Controlled SQL Primary Key
10CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
10 CVEs with CWE-566 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2014-0808Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is expl…EC-CUBE CO.,LTD. · EC-CUBE · CVSS 9.1 · 2014-01-22 | 9.1 | 2.2% | 2014-01-22 |
| CVE-2026-84650In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to submit configuration updates to specify…Jenkins Project · Jenkins · CVSS 8.8 · 2026-09-02 | 8.8 | 0.5% | 2026-09-02 |
| CVE-2024-22261SQL Injection in Harbor scan log APIHarbor · Harbor · CVSS 2.7 · 2024-06-10 | 2.7 | 0.4% | 2024-06-10 |
| CVE-2025-9953SQLi in Database Software's Databank Accreditation SoftwareDATABASE Software Training Consulting Ltd. · Databank Accreditation Software · CVSS 9.8 · 2026-02-19 | 9.8 | 0.4% | 2026-02-19 |
| CVE-2025-30368Zulip allows the deletion of organization by administrators of a different organizationzulip · zulip · CVSS 2.7 · 2025-03-31 | 2.7 | 0.3% | 2025-03-31 |
| CVE-2026-85749MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mailmailwatch · MailWatch · CVSS 8.1 · 2026-10-28 | 8.1 | 0.3% | 2026-10-28 |
| CVE-2025-30369Zulip allows the deletion of Custom profile fields by administrators of a different organizationzulip · zulip · CVSS 2.7 · 2025-03-31 | 2.7 | 0.3% | 2025-03-31 |
| CVE-2026-21886OpenCTI's GraphQL Mutations Allow Deletion of Unrelated EntitiesOpenCTI-Platform · opencti · CVSS 6.5 · 2026-03-17 | 6.5 | 0.3% | 2026-03-17 |
| CVE-2025-61781GraphQL IDOR allows authenticated user to delete workspace content of other usersOpenCTI-Platform · opencti · CVSS 7.1 · 2026-01-05 | 7.1 | 0.2% | 2026-01-05 |
| CVE-2025-56556An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query feature under the SQL Tool admin panel -…Intelliants · Subrion Cms · CVSS 3.8 · 2025-09-11 | 3.8 | 0.2% | 2025-09-11 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.