163 matches found
EUVD-2026-68060
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...
CVE-2026-80311 Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other...
CVE-2026-80311
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 contains an insecure direct object reference (IDOR) flaw: it does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it. This allows a user with a confirmed ...
CVE-2026-77789
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...
EUVD-2026-66289
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...
WordPress Stripe Payment Forms by WP Full Pay plugin < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure vulnerability
Unauthenticated Customer Portal Subscription and Billing Data Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WP Full Stripe Free versions 8.5.1...
CVE-2026-77789
CVE-2026-77789 affects the Stripe Payment Forms by WP Full Pay WordPress plugin in versions before 8.5.1 . The vulnerability is a cross-customer subscription modification via IDOR (Insecure Direct Object Reference): the plugin does not verify that a subscription belongs to the customer bound to t...
CVE-2026-77758 Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information...
CVE-2026-77758
CVE-2026-77758 affects the WP Full Stripe Free WordPress plugin (a.k.a. Stripe Payment Forms by WP Full Pay) in versions before 8.5.1 . The root cause is that the plugin does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing una...
CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint
Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...
SUSE CVE-2020-14391
A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Custom...
EUVD-2026-14308
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...
CVE-2026-4549
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...
CVE-2026-4549
CVE-2026-4549 affects mickasmt next-saas-stripe-starter 1.0.0. The openCustomerPortal function in actions/open-customer-portal.ts within the Stripe API is reported to enable an authorization bypass. Remote exploitation is described as possible with high attack complexity. No remediation details a...
CVE-2026-4549
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...
CVE-2026-4549 mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...
CVE-2026-4549 mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization
A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...
Next SaaS Stripe Starter 安全漏洞
Next SaaS Stripe Starter is an integrated payment and authentication SaaS project starter developed by mickasmt as a personal developer. Version 1.0.0 of Next SaaS Stripe Starter contains a security vulnerability. This vulnerability stems from incorrect operations on the openCustomerPortal functi...