CVE-2026-19127: Insufficient Verification of Data Authenticity

An issue in the billing and license activation subsystem allows remote attackers to bypass payment authorization workflows. By exploiting insufficient cryptographic validation or lack of server-side state verification on promotional/lifetime-deal LTD redemption codes, an unauthenticated attacker...

PT-2026-61650

Frappe LMS is an open source learning management system. In version 2.51.0 and earlier, a user could bypass payment validation for courses by using unrelated batch. This has been patched in 2.52.0 with enrollment now validating that the batch is linked to course...

CVE-2025-46018

CSC Pay Mobile App 2.19.4 fixed in version 2.20.0 contains a vulnerability allowing users to bypass payment authorization by disabling Bluetooth at a specific point during a transaction. This could result in unauthorized use of laundry services and potential financial loss...

PT-2024-24212 · Unknown · Designa Abacus

Name of the Vulnerable Software and Affected Versions: DESIGNA ABACUS versions prior to v.19 Description: The issue allows an attacker to bypass the payment process via a crafted QR code. Recommendations: For versions prior to v.19, update to a version that includes a fix for this issue to preven...

PT-2024-20101

Name of the Vulnerable Software and Affected Versions Authorize.net Payment Gateway For WooCommerce plugin for WordPress versions up to, and including, 8.0 Description The issue arises from the plugin's failure to properly verify the authenticity of requests that update an order's payment status...

CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher wil...

CVE-2023-26980

PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this because the attack is not feasible: the home launcher wil...

CVE-2021-4031: Insufficient Verification of Data Authenticity

Syltek application before its 10.22.00 version, does not correctly check that a product ID has a valid payment associated to it. This could allow an attacker to forge a request and bypass the payment system by marking items as payed without any verification...

Syltek application 数据伪造问题漏洞

Syltek application is an application. A security vulnerability previously existed in the Syltek application version 10.22.00 that allowed an attacker to spoof a request and bypass the payment system by marking the item as paid without any authentication...

CVE-2020-8818

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefor...

Authentication flaw

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...

CVE-2020-8818

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefor...

CVE-2020-8819

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings merchant ID, secret key, etc. and therefore bypass...

PT-2020-20301

Name of the Vulnerable Software and Affected Versions CardGate Payments plugin versions through 2.0.30 for Magento 2 Description The issue is related to the lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php. This allows an attacker to remotel...

CardGate < 3.1.16 - Unauthorised Payments Hijacking and Order Status Spoofing

Lack of origin authentication CWE-346 at IPN callback processing function allow even unauthorized attacker to remotely replace critical plugin settings merchant id, secret key etc with known to him and therefore bypass payment process eg. spoof order status by manually sending IPN callback reques...

CVE-2008-7310

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

CVE-2008-7310: Undefined Security Weakness

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability...

PT-2012-1266

Name of the Vulnerable Software and Affected Versions Spree version 0.2.0 Description The issue allows remote attackers to bypass the intended payment step by modifying a URL, related to a mass assignment vulnerability. This occurs because the software does not properly restrict the use of a hash...