29 matches found
CVE-2026-103671
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...
EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin" vulnerable to external control of assumed-immutable web parameter
Overview EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin provided by EC-CUBE CO.,LTD. contains the following vulnerability. External Control of Assumed-Immutable Web Parameter CWE-472 - CVE-2026-103671 The developer states that attacks exploiting the vulnerability has been observed. EC-CUBE...
CVE-2026-103671
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...
EUVD-2026-100939
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...
CVE-2026-103671
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...
CVE-2026-103671
A vulnerability exists in the AmazonPay Plugin for the EC-CUBE 4 series due to an external control of an assumed-immutable web parameter (CWE-472). If exploited, an attacker can redirect users to an arbitrary website during the ordering process, potentially leading to the theft of user account in...
CVE-2026-103671: External Control of Assumed-Immutable Web Parameter
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...
VulnCheck KEV: CVE-2026-103671
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin for EC-CUBE 4 series "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained...
PT-2026-113722
Name of the Vulnerable Software and Affected Versions AmazonPay Plugin for EC-CUBE 4 series affected versions not specified Description An issue exists where an assumed-immutable web parameter is under external control. This allows an attacker to redirect users to an arbitrary website during the...
CVE-2026-58244 Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII)
SAP Manufacturing Integration and Intelligence MII does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacker to access information that should be restricted to privileged users. Successful exploitation could allow the attacker...
CVE-2026-54105
The CVE concerns CVE-2026-54105 affecting the GAO EPDS and CBCA EDS systems. The vulnerability arises from the update-profile/ API endpoint, where a remote, unauthenticated attacker can supply an arbitrary user_id and receive a JSON response containing account-specific information, including the ...
CVE-2023-30216: Authorization Bypass Through User-Controlled Key
Insecure permissions in the updateUserInfo function of newbee-mall before commit 1f2c2dfy allows attackers to obtain user account information...
Information disclosure
An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure password policy...
Google Android security vulnerabilities
Google Android is a Linux-based open source operating system from Google Inc. in the United States. A security vulnerability exists in Google Android 13, which stems from a lack of permission checking in ContentService, which could potentially check for the existence of an account on the device,...
Google Android security vulnerabilities
Google Android is a Linux-based open source operating system from Google Inc. in the United States. A security vulnerability exists in Google Android 13, which stems from a lack of permission checking in ContentService, which could potentially check for the existence of an account on the device,...
CVE-2021-27768: Channel Accessible by Non-Endpoint
Using the ability to perform a Man-in-the-Middle MITM attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode...
CVE-2021-42336: Improper Authorization
The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can access other users’ and administrator’s account information except password by crafting URL parameters...
CVE-2021-37468
NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files...
CVE-2019-5492: Undefined Security Weakness
Element Plug-in for vCenter Server versions prior to 4.2.3 may disclose sensitive account information to an unauthenticated attacker. NetApp HCI Compute Node versions prior to 1.4P2 bundle affected versions of Element Plug-in for vCenter Server...