CVE-2026-109160

A vulnerability exists in PublicCMS versions up to 5.202608.a within the pay Endpoint . Specifically, the function SafeConfigComponent.getSafeUrl in the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java is susceptible to manipulation of the returnUrl ...

CVE-2026-80340 Payment Plugins for PayPal WooCommerce < 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that...

PT-2025-4033 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and below Description: An Improper Access Control issue has been found, allowing an authenticated attacker to change their subscription plan without paying. This is achieved by making a POST request to the...