4 matches found
CVE-2026-115450
External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...
CVE-2026-115450 Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...
CVE-2026-115450
The MarcosCamara01 Ecommerce Template contains a price manipulation vulnerability (CWE-472 ) within its cart and checkout flow. The POST /api/user/cart endpoint independently accepts variantId (used for order records) and stripeId (used for Stripe charges) without verifying their association. An ...
EUVD-2026-108212
External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...