CVE-2026-103376 PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376 PeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check

The PeachPay — Payments & Express Checkout for WooCommerce supports Stripe, PayPal, Square, Authorize.net, NMI WordPress plugin before 1.120.70 does not perform any capability or ownership check before returning an order's secret key in response to an unauthenticated request, allowing anyone to...

CVE-2026-103376

The PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin, versions 1.117.9 through 1.120.69 , is vulnerable to unauthenticated order key disclosure. The software fails to perform necessary capability or ownership checks before returning an order's secret key in response to an u...

EUVD-2021-15884

Malware in sbrugna...

EUVD-2021-15889

Malware in sbrugna...

EUVD-2021-15886

Malware in sbrugna...

EUVD-2021-15887

Malware in sbrugna...

EUVD-2021-15888

Malware in sbrugna...

EUVD-2021-15890

Malware in sbrugna...

EUVD-2022-36050

Malicious code in bioql PyPI...

CVE-2022-32984

BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the...

CVE-2021-29247

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for a cookie...

CVE-2021-29245

BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key...

CVE-2021-29246

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. The attacker must craft a malicious plugin file with special characters to upload the file outside of the restricted directory...

CVE-2021-29248

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a cookie...

CVE-2021-29250

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting XSS vulnerability within the POS Add Products functionality. This enables cookie stealing...

CVE-2021-29251

BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register in Server Settings Policies. This affects Docker use cases in which a mail server is configured...

CVE-2021-29249

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability...

chatbot (>=0.0.3, <=0.2.3), chinillaclvmr (>=0.1.24, <=0.2.0) +13 more potentially affected by CVE-2023-53159 via openssl (>=0.10.7, <=0.10.52)

openssl CARGO version =0.10.7, =0.0.3, =0.1.24, =0.1.22, =0.1.24, =0.1.0, =0.1.0-beta.1, =0.1.24, =0.0.1, =0.1.0, =0.1.0, =0.7.1, =0.1.0, =0.9.0, =0.9.4 - ya-client-model 0.2.0 Source cves: CVE-2023-53159 Source advisory: GHSA-XCF7-RVMH-G6Q4...

BTCPay Server 1.7.4 HTML Injection

Exploit Title: BTCPay Server v1.7.4 - HTML Injection Date: 01/26/2023 Exploit Author: Manojkumar J TheWhiteEvil Vendor Homepage: https://github.com/btcpayserver/btcpayserver Software Link: https://github.com/btcpayserver/btcpayserver/releases/tag/v1.7.5 Version: clickhere 3. Click remove/delete A...