1023 matches found
Malicious code in clover-codelab-remote-pay-cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...
MAL-2026-12366 Malicious code in dolyame-boxy-independent-bnpl-open-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b38c4f57c90f57ca8c3a54ebf790e726dcbba0be7a662f3ae2aa706c5521d5b On require of the package, index.js loads helpers.js which immediately invokes start. start selects a Windows, Linux, or macOS payload path, download...
Malicious code in checkout-mobile-pay-button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...
MAL-2026-12352 Malicious code in checkout-mobile-pay-button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3299d3b20175ec3cd68c2355ccafd1e969237d93b2e708c92a9913ff323b19be [email protected] is a lure package: its name and README describe a 'mobile pay button platform adapter', but index.js unconditionall...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
EUVD-2026-51795
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635 Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the maybeupdateuserrole function passing an attacker-controlled Gravity Forms field value $lead$feed-userrolefieldid directly into WPUser::setrole without any...
CVE-2026-16635
The CVE concerns the Pronamic Pay plugin for WordPress (up to version 10.1.0). The vulnerability lies in the maybe_update_user_role() function, which passes an attacker-controlled Gravity Forms field value ($lead[$feed->user_role_field_id]) directly into WP_User::set_role() without allowlist v...
EUVD-2026-48177
Unauthenticated Broken Access Control in Knit Pay = 9.6.0.0 versions...
CVE-2026-57717
CVE-2026-57717 corresponds to an unauthenticated broken access control vulnerability in the WordPress Knit Pay plugin, affecting versions
EUVD-2026-46953
Vulnerability in the PeopleSoft Enterprise FIN Pay/Bill Management product of Oracle PeopleSoft component: Paybill Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterpris...
CVE-2026-60595
Vulnerability in the PeopleSoft Enterprise FIN Pay/Bill Management product of Oracle PeopleSoft component: Paybill Management. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterpris...
WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Riyas M S in WordPress Plugin Knit Pay versions = 9.6.0.0...
CVE-2026-1989
Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
EUVD-2026-42553
Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2026-1989
Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
CVE-2026-1989
Technical details of CVE-2026-1989 are not publicly available in the provided documents; monitor for updates.
CVE-2026-1989 IDOR in PAVO Inc.'s PAVO Pay
Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...
VulnCheck KEV: CVE-2026-31843
The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...