XWiki Platform - SQL Injection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2026-110613

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the omsorder table using a self-registered account to read order ids, ordersn values,...

CVE-2026-110607

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers can generate a payment log via /member/payment/load and request...

EUVD-2026-101241

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the omsorder table using a self-registered account to read order ids, ordersn values,...

CVE-2026-110613 youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the omsorder table using a self-registered account to read order ids, ordersn values,...

CVE-2026-110613 youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the omsorder table using a self-registered account to read order ids, ordersn values,...

CVE-2026-110613

The youlai-mall software (through commit 9f62de8 ) contains a missing authorization vulnerability in the app order list endpoint. This flaw allows authenticated members to access and view order information belonging to every customer. By using a self-registered account, an attacker can paginate t...

WordPress Asaas Gateway for WooCommerce plugin < 2.7.8 - Unauthenticated Order Payment Bypass vulnerability

Unauthenticated Order Payment Bypass vulnerability discovered by Guillermo Álvarez Fernández in WordPress Plugin Asaas Gateway for WooCommerce versions 2.7.8...

WordPress Trust Payments Gateway for WooCommerce plugin < 3.1.0 - Unauthenticated Order Payment Completion vulnerability

Unauthenticated Order Payment Completion vulnerability discovered by ryan fabella in WordPress Plugin Trust Payments Gateway for WooCommerce versions 3.1.0...

WordPress WP Encryption plugin < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability

Unauthenticated Certificate Private Key and ACME Order Replacement vulnerability discovered by Artus KG and Shhriyash in WordPress Plugin WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content versions 7.8.8.2...

WordPress Walletdoc Payment Gateway for WooCommerce plugin < 1.8.5 - Unauthenticated SQLi and Order Payment Forgery vulnerability

Unauthenticated SQLi and Order Payment Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Walletdoc Payment Gateway for WooCommerce versions 1.8.5...

WordPress Visma Pay for WooCommerce plugin < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure vulnerability

Unauthenticated Payment Bypass and Order Data Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Visma Pay for WooCommerce versions 1.2.2...

CVE-2026-88998

The Tickera WordPress plugin, specifically versions prior to 3.6.0.4 , is vulnerable to an unauthenticated order payment bypass via 2Checkout IPN . The root cause is the plugin's failure to correctly verify the integrity of incoming payment notifications; specifically, the validated signature doe...

WordPress Tickera plugin < 3.6.0.4 - Unauthenticated Order Payment Bypass vulnerability

Unauthenticated Order Payment Bypass vulnerability discovered by ryan fabella in WordPress Plugin Tickera versions 3.6.0.4...

CVE-2026-87974

The Asaas Gateway for WooCommerce WordPress plugin before 2.7.8 does not properly authenticate its payment webhook, accepting an empty access token in its default configuration and not verifying that the confirmed payment corresponds to the order it marks paid, allowing unauthenticated attackers ...

CVE-2026-87843

The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers t...

CVE-2026-107594

The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the...

CVE-2026-94360

The Paymentfor Gateway for WooCommerce WordPress plugin, in versions prior to 1.0.6 , is vulnerable to an unauthenticated order payment forgery . The root cause is a failure to verify the authenticity of inbound payment notifications before updating an order's status to paid. This allows unauthen...

CVE-2026-94360 Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks

The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any payment being completed...

WordPress Paymentfor Gateway for WooCommerce plugin < 1.0.6 - Unauthenticated Order Payment Forgery vulnerability

Unauthenticated Order Payment Forgery vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc, Naoki Kawahigashi in WordPress Plugin Paymentfor Gateway for WooCommerce versions 1.0.6...