CVE-2025-55886

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint. An authenticated attacker can manipulate this parameter to access the payment history of other users without authorization.

• CWE-693

• https://github.com/0xZeroSec/CVE-2025-55886
• https://services.ard.fr

Published

Sep 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55852Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in t…7.5
• CVE-2025-55853SoftVision webPDF before 10.0.2 is vulnerable to Server-Side…9.1
• CVE-2025-5586The WordPress Ajax Load More and Infinite Scroll plugin for …6.4
• CVE-2025-5587The Appzend theme for WordPress is vulnerable to Stored Cros…6.4
• CVE-2025-5588The Image Editor by Pixo plugin for WordPress is vulnerable …6.4
• CVE-2025-55885SQL Injection vulnerability in Alpes Recherche et Developpem…6.3
• CVE-2025-55887Cross-Site Scripting (XSS) vulnerability was discovered in t…6.1
• CVE-2025-55888Cross-Site Scripting (XSS) vulnerability was discovered in t…7.3
• CVE-2025-5589The StreamWeasels Kick Integration plugin for WordPress is v…6.4
• CVE-2025-55893TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to comm…6.5
• CVE-2025-55895TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6…9.1
• CVE-2025-5590The Owl carousel responsive plugin for WordPress is vulnerab…8.8