VulnerabilitySANS NewsBites
Official Papal Prayer App Exposed Data of Every User
NEOSEC enrichment — no mirror of the original source
An independent security researcher discovered that "Click to Pray," a Vatican-endorsed Catholic prayer guidance app and website launched in 2016, had an Insecure Direct Object Reference (IDOR) flaw that exposed the personal information of a
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Neely.
Linked advisories
Affected vendors and products
More on Official
Other advisories
- MediumCVE-2026-113813PayPlug for WooCommerce (Official): Sicherheitslücke
- MediumCVE-2026-110292PayPlug for WooCommerce (Official): Sicherheitslücke
- MediumCVE-2026-113813PayPlug for WooCommerce (Official): Sicherheitslücke
- MediumCVE-2026-110292PayPlug for WooCommerce (Official): Sicherheitslücke
- Not ratedosv:CVE-2026-114123D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet
- HighCVE-2026-84316Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
- HighCVE-2026-84317Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI
- HighCVE-2026-111366Cool-team-official Cool-admin-midway: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
Other news entries
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution FlawNewsThe Hacker News
- uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat AccountsNewsThe Hacker News
- Bubble says an attacker accessed users' third-party API keys and tokens in an active security incidentBreachpwn.watch
- Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli DataNewsThe Hacker News
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security AlertNewsThe Hacker News
- WordPress SEO plugin Rank Math compromised to backdoor websitesNewsBleepingComputer
- Good Smile Company: official online shop breached, member details and partial card data possibly viewedBreachpwn.watch
- Hallucinated domain in official OpenAI skill underscores AI supply chain risksNewsCSO Online
ID