698 matches found
Payment Gateway for Telcell < 2.0.4 - Open Redirect
The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...
CVE-2020-28415
CVE-2020-28415 Suggested description परावर्तित क्रॉस-साइट स्क्रिप्टिंग XSS कमजोरी TranzWare Payment Gateway 3.1.12.3.2 में मौजूद है। एक रिमोट अप्रमाणित हमलावर क्राफ्टेड url के माध्यम से मनमाना HTML कोड निष्पादित करने में सक्षम है CVE-2020-28414 से भिन्न वेक्टर। Vulnerability Type क्रॉस साइट...
CVE-2020-28414
CVE-2020-28414 सुझाया गया विवरण TranzWare Payment Gateway 3.1.12.3.2 में एक परावर्तित क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता मौजूद है। एक दूरस्थ अप्रमाणित हमलावर एक निर्मित यूआरएल के माध्यम से मनमाना HTML कोड निष्पादित करने में सक्षम है। भेद्यता प्रकार क्रॉस साइट स्क्रिप्टिंग XSS उत्पाद का विक्रेता...
WordPress ePayco Payment Gateway for WooCommerce plugin < 8.4.7 - Unauthenticated Payment Confirmation Bypass vulnerability
Unauthenticated Payment Confirmation Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Epayco versions 8.4.7...
CVE-2026-84043
The ePayco Payment Gateway for WooCommerce WordPress plugin, in versions before 8.4.7 , fails to properly verify the authenticity of payment confirmation requests. This allows unauthenticated attackers to mark orders as paid without presenting a valid gateway signature, resulting in a low integri...
EUVD-2026-70991
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...
EUVD-2026-68992
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...
CVE-2026-13611 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...
CVE-2026-13611
The KiviCare WordPress plugin (a Clinic & Patient Management System / EHR) prior to version 4.5.5 is missing authorization checks on certain REST endpoints , enabling unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...
EUVD-2026-68044
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...
DRUPAL-CONTRIB-2026-106
This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...
Commerce CyberSource - Moderately critical - Insufficient input validation - SA-CONTRIB-2026-106
This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...
CVE-2026-16738
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...
CVE-2026-16738 Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...
CVE-2026-16738
The Conekta Payment Gateway WordPress plugin (versions before 6.2.2 ) fails to verify the authenticity of incoming payment gateway webhook notifications and does not bind the confirmed payment to the targeted order or validate its amount. This allows unauthenticated attackers to forge webhook req...
EUVD-2026-64218
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...
CVE-2026-15150
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...
EUVD-2026-63909
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...