CVE-2026-90896

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

CVE-2026-90896

CVE-2026-90896 is a Missing Authentication for Critical Function (CWE-306) in the MarcosCamara01 Ecommerce Template before commit 91e273c . The GET /api/stripe/checkout_sessions endpoint (in src/app/api/stripe/checkout_sessions/route.ts) calls stripe.checkout.sessions.retrieve() and returns the f...

CVE-2026-90896 Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII

Missing Authentication for Critical Function CWE-306 in the checkout session lookup handler src/app/api/stripe/checkoutsessions/route.ts, exposed at GET /api/stripe/checkoutsessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a val...

PT-2026-91735

Name of the Vulnerable Software and Affected Versions MarcosCamara01 Ecommerce Template versions prior to commit 91e273c Description Missing authentication in the checkout session lookup handler allows a remote, unauthenticated attacker to retrieve full session objects. By providing a valid Strip...

CVE-2026-14830 FlxWoo < 3.1.1 - Unauthenticated Payment Bypass

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying...

CVE-2026-14830

The FlxWoo WordPress plugin (versions before 3.1.1 ) contains an Unauthenticated Payment Bypass vulnerability. The root cause is a failure to verify with the payment processor that a checkout session was actually paid before the plugin marks the associated order as paid. This allows unauthenticat...

PT-2023-21370 · Unknown · Prestashop Lekerawen Ocs

Name of the Vulnerable Software and Affected Versions: PrestaShop lekerawen ocs versions prior to 1.4.1 Description: A SQL injection issue allows a remote attacker to gain privileges via the KerawenHelper::setCartOperationInfo and KerawenHelper::resetCheckoutSessionData components. Recommendation...