Login as User or Customer < 3.3 - Privilege Escalation

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. id: CVE-2022-4305 info: name: Login as User or Customer 3.3 - Privilege Escalation author: r3Y3r53 severity: critical...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

EUVD-2026-91213

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987

The Easy PayPal & Stripe Buy Now Button WordPress plugin, in versions 1.8 through 2.0.5 , is vulnerable to unauthenticated payment amount manipulation . The root cause is that the plugin fails to derive the payment amount on the server, instead relying on a client-supplied field . This allows an ...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987 Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

WordPress Easy PayPal & Stripe Buy Now Button plugin 1.8-2.0.5 - Unauthenticated Payment Amount Manipulation vulnerability

Unauthenticated Payment Amount Manipulation vulnerability discovered by JunHee CHO in WordPress Plugin Easy PayPal Buy Now Button versions 1.8-2.0.5...

PT-2026-104112

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

CVE-2026-90987: External Control of Assumed-Immutable Web Parameter

The Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a client-supplied field, so an unauthenticated attacker sets an arbitrary lower price for a purchase...

GO-2026-6584 Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go

Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...

CVE-2026-103539

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

EUVD-2026-90496

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

CVE-2026-103539 ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

CVE-2026-103539

A vulnerability exists in ZongXR SuperMarket 1.0.0.0 within the Instant Buy component. Specifically, the startBuy function in instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java fails to perform proper authentication. By manipulating the Username argument, a ...

CVE-2026-103539 ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

PT-2026-103674

Name of the Vulnerable Software and Affected Versions ZongXR SuperMarket version 1.0.0.0 Description A weakness in the Instant Buy component allows remote attackers to bypass authentication. This occurs through the manipulation of the Username argument within the startBuy function located in the...

CVE-2026-103539: Missing Authentication for Critical Function

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

PT-2026-105602

Klever-Go: Zombie-order theft: Buy missing IsClaimed guard in native marketplace in github.com/klever-io/klever-go...

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Location: core/kapp/market/market.go — Buy approx. L281–436\ Severity: High The native marketplace enforces an IsClaimed guard in Claim market.go:752, CancelOrder market.go:1125, and orderEscrowAmount market.go:251, but not in Buy. Marketplace escrow is virtual: the market KApp account never...

GHSA-26R5-4MM2-PX5C Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

Location: core/kapp/market/market.go — Buy approx. L281–436\ Severity: High The native marketplace enforces an IsClaimed guard in Claim market.go:752, CancelOrder market.go:1125, and orderEscrowAmount market.go:251, but not in Buy. Marketplace escrow is virtual: the market KApp account never...