CVE-2024-8860

The CVE-2024-8860 case concerns the WordPress Tourfic plugin (versions up to and including 2.14.5). The vulnerability arises from missing capability checks in multiple functions (tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order...

Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067

This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed...

PT-2025-11609

Name of the Vulnerable Software and Affected Versions TastyIgniter version 3.7.6 Description The issue is related to an Incorrect Access Control flaw in the Orders Management System, allowing unauthorized users to update order statuses. This occurs due to a failure in verifying user permissions...