CVE-2025-60982

IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object identifiers in API requests. Attackers can exploit this flaw to view or modify sensitive records without proper authorization.

• CWE-284

• https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md
• https://www.educare.school/
• https://github.com/handyteddy/Security-Advisories/blob/main/Educare-IDOR.md

Published

Oct 27, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-60964OS Command Injection vulnerability in EndRun Technologies So…9.1
• CVE-2025-60965OS Command Injection vulnerability in EndRun Technologies So…9.1
• CVE-2025-60967Cross Site Scripting (XSS) vulnerability in EndRun Technolog…7.3
• CVE-2025-60969Directory Traversal vulnerability in EndRun Technologies Son…5.7
• CVE-2025-6097A vulnerability was found in UTT 进取 750W up to 5.0 and class…9.8
• CVE-2025-6098A vulnerability was found in UTT 进取 750W up to 5.0. It has b…9.8
• CVE-2025-60983Reflected Cross Site Scripting vulnerability in Rubikon Bank…5.4
• CVE-2025-6099A vulnerability was found in szluyu99 gin-vue-blog up to 61d…5.5
• CVE-2025-60991A reflected cross-site scripted (XSS) vulnerability in Codaz…8.8
• CVE-2025-6100A vulnerability was found in realguoshuai open-video-cms 1.0…6.3
• CVE-2025-6101A vulnerability classified as critical has been found in let…5.5
• CVE-2025-61018An issue in the sqlo_place_dt_set component of openlink virt…7.5