VulnerabilitySANS NewsBites
Official Papal Prayer App Exposed Data of Every User
NEOSEC enrichment — no mirror of the original source
An independent security researcher discovered that "Click to Pray," a Vatican-endorsed Catholic prayer guidance app and website launched in 2016, had an Insecure Direct Object Reference (IDOR) flaw that exposed the personal information of a
Source: SANS NewsBites. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Editorial context in the original issue
The SANS NewsBites issue carries commentary by: Neely.
Linked advisories
Affected vendors and products
More on Official
Other advisories
- Highosv:MAL-2026-18476Malicious code in justinofficial (npm)
- Highosv:MAL-2026-18467Malicious code in @nuxzofficial/baileys (npm)
- Highosv:MAL-2026-18469Malicious code in nuxzofficial (npm)
- Not ratedosv:CLEANSTART-2024-SE64103jQuery-UI is the official jQuery user interface library
- Not ratedosv:CLEANSTART-2026-RY81711Sentry-Javascript is an official Sentry SDKs for JavaScript
- Not ratedosv:CLEANSTART-2026-ID97567Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents
- MediumCVE-2026-113813PayPlug for WooCommerce (Official): Sicherheitslücke
- MediumCVE-2026-110292PayPlug for WooCommerce (Official): Sicherheitslücke
Other news entries
- FBI Flags Over 600 Addresses Tied to North Korea’s Binance HeistNewsSecurityWeek
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto HeistNewsThe Hacker News
- b14g: about 97M CORE drained from its Core staking contracts; contracts pausedBreachpwn.watch
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH BackdoorNewsThe Hacker News
- Belgium's tax agency confirms cyberattack, pulls services offlineNewsThe Register — Security
- Shadowy AI Relay Disables OpenAI Codex, Claude Code SandboxesNewsDark Reading
- Binance says its $6.3B hack went beyond a compromised DevOps laptop; it will cover all losses and about $3B is frozenBreachpwn.watch
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution FlawNewsThe Hacker News
ID