1007 matches found
CVE-2026-73384
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...
CVE-2026-73384 WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...
EUVD-2026-62385
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...
CVE-2026-73384
Pay with Contact Form 7 is a WordPress plugin affected by an unauthenticated sensitive data exposure vulnerability in versions
PT-2026-78341
Name of the Vulnerable Software and Affected Versions Pay with Contact Form 7 versions prior to 1.0.5 Description An issue exists that allows unauthenticated users to cause sensitive data exposure. Recommendations Update to a version newer than 1.0.4...
CVE-2026-67585
Allocation of Resources Without Limits or Throttling vulnerability in DivvyPayHQ absinthefederation allows an unauthenticated remote attacker to abort the Erlang VM via crafted entities representation keys. Every key of every object in the representations argument of the federation-mandated...
Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...
Malicious code in dolyame-boxy-desktop-bnpl-button-set (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f786ddb8f05c51044f41661db16ceb96657060ba36d0ead043d430cf4e30a11 Requiring the package loads vendor.js, which reconstructs remote hosts from array-join fragments resolving to Cloudflare Workers hosts such as...
Malicious code in clover-codelab-remote-pay-cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...
MAL-2026-12366 Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...
Malicious code in checkout-mobile-pay-button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...
MAL-2026-12352 Malicious code in checkout-mobile-pay-button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
EUVD-2026-51795
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635 Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635
The CVE concerns the Pronamic Pay plugin for WordPress (up to version 10.1.0). The vulnerability lies in the maybe_update_user_role() function, which passes an attacker-controlled Gravity Forms field value ($lead[$feed->user_role_field_id]) directly into WP_User::set_role() without allowlist v...
EUVD-2026-48177
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
CVE-2026-57717
CVE-2026-57717 corresponds to an unauthenticated broken access control vulnerability in the WordPress Knit Pay plugin, affecting versions
EUVD-2026-46953
Vulnerability in the PeopleSoft Enterprise FIN Pay/Bill Management product of Oracle PeopleSoft component: Paybill Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterpris...