EUVD-2026-95023

pH7Builder pH7 Social Dating CMS before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members to obtain any membership tier by supplying client-controlled plan and amount fields. Attackers can set itemnumber, cartorderid, or the PayPal custom field while...

CVE-2026-15502: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The manipulation of the argument itemnumber results in sql injection. The attack may be performed from remote. The vendor was contacte...