58 matches found
CVE-2026-70658
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...
EUVD-2026-77680
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...
CVE-2026-70658
Pay is a payments engine for Ruby on Rails 6.0+. Prior to version 11.6.2 , the method Pay::Webhooks::PaddleBillingController#valid_signature? compares the computed 64-character SHA-256 HMAC against the attacker-controlled h1 token from the Paddle-Signature header using Ruby's String#== (a non-con...
CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...
CVE-2026-70658 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingControllervalidsignature? in app/controllers/pay/webhooks/paddlebillingcontroller.rb compares the computed 64-character SHA-256 HMAC with the attacker-controlled h1 token from the...
CVE-2026-58411
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...
CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...
CVE-2026-58411
ChurchCRM (open-source church management system) Vulnerability: Prior to version 7.4.0, a Reflected XSS was identified due to insufficient output encoding of user-controlled request parameter names and values. The application reflects attacker-controlled input into JavaScript string contexts and ...
GHSA-MJGF-XJ26-9QF9 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...
Timing Attack
Overview pay is a package for processing payments in Ruby on Rails apps Affected versions of this package are vulnerable to Timing Attack via the validsignature? function. An attacker can recover valid webhook signatures by sending multiple requests with crafted Paddle-Signature header values and...
PYSEC-2026-442 PaddlePaddle Path Traversal vulnerability
Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6...
MAL-2026-2829 Malicious code in paddle-internal-scripts (npm)
Malicious package due to sensitive data exfiltration via obfuscated preinstall script. Few published versions increase suspicion. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae655788b800d689464263a26d904ccb45fe4aa65b61422a51325008aff3003 The package...
Malicious code in paddle-internal-scripts (npm)
Malicious package due to sensitive data exfiltration via obfuscated preinstall script. Few published versions increase suspicion. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae655788b800d689464263a26d904ccb45fe4aa65b61422a51325008aff3003 The package...
EUVD-2026-5023
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint /PaddleNumEditor.php in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the PerID parameter. Version 6.7...
CVE-2026-24854 Church CRM has SQL injection in PaddleNumEditor.php
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint /PaddleNumEditor.php in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the PerID parameter. Version 6.7...
PT-2026-5407
Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.7.2 Description ChurchCRM is an open-source church management system. A SQL Injection issue exists in the /PaddleNumEditor.php endpoint. Any authenticated user, even with limited permissions, can exploit SQL...
Malicious code in paddle-subscription (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9751 Malicious code in paddle-subscription (npm)
--- -= Per source details. Do not edit below this line.=-...
