CVE-2026-66488 Joomla Extension - balbooa.com - Payment bypass in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...

EUVD-2026-50335

Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...

Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates

Source code for the Flying Eagle Android remote access trojan RAT framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public...

CVE-2026-13692

The CVE-2026-13692 entry concerns the PayU CommercePro Plugin for WordPress up to version 3.8.9. The vulnerability is that the plugin does not verify the payment-gateway signature before applying order modifications, enabling unauthenticated attackers to tamper with the totals, shipping, and meta...

CVE-2026-13692 PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

CVE-2026-17166

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

EUVD-2026-50098

The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an...

PT-2026-65806

Joomla Extension - balbooa.com - Payment bypass in Gridbox 2.20.2...

CVE-2026-4648 Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands

Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands from CasfID Servicios Tecnológicos S.L.U. version used at Resurrection Fest 2025, which employs cards based on MIFARE Classic technology FM11RF08S. The cryptographic weakness of the authentication...

CVE-2026-18029

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-18029

The CVE-2026-18029 entry is tied to the pretix-girosolution payment integration. Affected component: payment status validation in GiroCheckout flow. Root cause: insufficient validation of payment status responses, enabling an attacker to reuse a successful status for one payment with a different ...

CVE-2026-18029 Insufficient validation of payment status in pretix-girosolution

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

EUVD-2026-49752

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-15673

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...

CVE-2026-15673

CVE-2026-15673 affects the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” up to version 3.9.7. It is a second‑order SQL Injection where insufficient escaping in the update_option‑stored values in checkout_payment_plans and order_status allo...

CVE-2026-14926

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...

EUVD-2026-49703

The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method endpoints, allowing any authenticated customer to act on another customer's subscription changing its payment method, or...