CVE-2026-70658

Pay is a payments engine for Ruby on Rails 6.0+. Prior to version 11.6.2 , the method Pay::Webhooks::PaddleBillingController#valid_signature? compares the computed 64-character SHA-256 HMAC against the attacker-controlled h1 token from the Paddle-Signature header using Ruby's String#== (a non-con...

pay-rails Pay 跨站脚本漏洞

pay-rails Pay is a payment engine for Ruby on Rails. A cross-site scripting vulnerability exists in pay-rails Pay versions prior to 6.3.2, which stems from the presence of reflective cross-site scripting...