CVE-2022-47130

CVE-2022-47130 Academy LMS history.pushState'', '', '/'...

CVE-2023-40869

CVE-2023-40869 Cross Site Scripting vulnerability in mooSocial mooSocial Software v.3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a crafted script to the editmenu, copuon, and groupcategorias functions XSS STORE via CSRF. Paths Affected...

CVE-2026-118541

Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13...

CVE-2026-118804: Bricks Bricks Builder: Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to…

Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted poststatus and posttype values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/queryresult REST endpoint...

Promotion and coupon usage limit bypass via race condition

More info at https://github.com/Sylius/Sylius/security/advisories/GHSA-h76r-rr27-3gm4...

CVE-2026-112285

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112285

The Thelia e-commerce platform is affected by a business logic vulnerability in versions prior to 3.1.5 and 3.2.x before 3.2.4 . The flaw arises because coupon usage is only recorded once an order is paid. Authenticated customers can exploit this by placing multiple pay-later orders to bypass usa...

EUVD-2026-104288

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112285

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112285 Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-106028 ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

CVE-2026-106028 ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

WordPress ActiveTrail for WooCommerce plugin <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation vulnerability

Unauthenticated Arbitrary Coupon Creation vulnerability discovered by Ryan Fabella in WordPress Plugin ActiveTrail for WooCommerce versions = 1.2.6...

CVE-2026-106028

The ActiveTrail for WooCommerce WordPress plugin, in versions up to and including 1.2.6 , is vulnerable to an authorization bypass. The plugin fails to perform adequate authorization checks when creating WooCommerce coupons, which allows unauthenticated attackers to create arbitrary coupons. This...

CVE-2026-112285: Improper Enforcement of a Single, Unique Action

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

PT-2026-117429

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

Thelia processing logic vulnerability

Versions of Thelia prior to 3.1.5 and 3.2.4, as well as 3.2.x versions, have a processing logic vulnerability. This vulnerability arises from the fact that the number of coupon uses is only counted after the order payment is made. Certified customers can circumvent the coupon usage restrictions b...

CVE-2026-110035 Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from...