Code injection

BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the...

CVE-2022-32984

BTCPay Server 1.3.0–1.5.3 is affected by CVE-2022-32984. The issue allows a remote attacker viewing a publicly exposed Point of Sale app to access sensitive data contained in the HTML source, including the store’s xpub and, if an internal lightning node isn’t used, lightning node credentials. The...