CVE-2026-116254

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

CVE-2026-116254 rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

EUVD-2026-109707

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

CVE-2026-116254

A vulnerability exists in rathena FluxCP (up to version 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d) affecting the PayPal IPN Handler component. Specifically, the verifyiprange function in lib/Flux/PaymentNotifyRequest.php is susceptible to an origin validation error due to the manipulation of the X...

CVE-2026-116254 rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

rAthena FluxCP input validation error vulnerability

The rAthena FluxCP system contains an input validation error vulnerability. This vulnerability stems from improper handling of the X-Real-IP parameter by the verifyiprange function within the file lib/Flux/PaymentNotifyRequest.php in the PayPal IPN Handler component. As a result, source...

PT-2026-123244

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation...

CVE-2026-108826

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

CVE-2026-108826

A SQL injection vulnerability exists in Zen Cart up to version 2.2.2 . The flaw is located in the PayPal IPN Handler component, specifically within the zen_db_perform function in the includes/modules/payment/paypaldp.php library. An attacker can initiate this attack remotely by manipulating the t...

CVE-2026-108826

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

CVE-2026-108826 Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

CVE-2026-108826 Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

CVE-2026-108826 Zen Cart PayPal IPN paypaldp.php zen_db_perform sql injection

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

EUVD-2026-97330

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

CVE-2026-108826: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

PT-2026-110537

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen db perform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txn id results in sql injection. The attack can be initiated remotely. Th...

CVE-2026-81423 Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing...

CVE-2026-81423

The Accept Stripe Payments WordPress plugin (versions before 2.1.4 ) contains an Open Redirect vulnerability. The root cause is a failure to validate a user-supplied URL before utilizing it in a redirect, specifically through the IPN Handler . This allows unauthenticated attackers to redirect web...

CVE-2026-81423 Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler

The Accept Stripe Payments WordPress plugin before 2.1.4 does not validate a user-supplied URL before using it in a redirect, allowing unauthenticated attackers to redirect visitors to an arbitrary external website, which can be leveraged for phishing...

CVE-2026-17008

The Quick Paypal Payments WordPress plugin through 5.7.50 does not verify the paid amount, receiver, or payment status in its PayPal IPN handler and marks an order paid on an order-token match alone, so a buyer who pays an arbitrary small amount can have a full-price order marked paid...