6152 matches found
Gpt-Agreement-Payment
简体中文 | English Gpt-Agreement-Payment End-to-end replay tool for ChatGPT Plus / Team subscription agreements: reverse-engineered from packet capture the entire chain Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE and implemented as a runnable client. Include...
CVE-2026-86406
The User Registration & Membership WordPress plugin (versions before 5.2.8 ) fails to check the capability of the user initiating a membership purchase and does not validate the submitted payment method or plan. This allows any authenticated user at the subscriber level to receive the WordPress r...
CVE-2026-88764 Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing members to pay for a lower-priced membership while being granted a higher, more privileged...
EUVD-2026-76954
The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it, allowing any authenticated user such as a subscriber to be granted the WordPress role...
CVE-2025-22652
CVE-2025-22652 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Nombre del componente Payment Forms for Paystack Versión vulnerable = 4.0.1 Slug del componente payment-forms-for-paystack Enlace del componente https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP...
PayPlus Payment Gateway < 6.6.9 - SQL Injection
The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability. id: CVE-2024-6205 info: name: PayPlus Payment...
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id
The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The createpaymentintent AJAX handler checks if $formid 0 && !empty$blockid before calling validatepaymentamount. By sending formid=0 the default intval of a missing/zero...
Code-Projects School Fees Payment System 1.0 - SQL Injection
A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been...
WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery
WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...
Payment Gateway for Telcell < 2.0.4 - Open Redirect
The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...
CVE-2024-21514
CVE-2024-21514 PoC y Escáner Masivo Resumen POC para CVE-2024-21514 : Se identificó un problema de inyección SQL en la extensión de pago Divido para OpenCart, que está incluida por defecto en la versión 3.0.3.9 Este POC fue creado por M Ali y está basado en este Aviso de Seguridad de Snyk. Cómo...
CVE-2026-87892
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
CVE-2026-77689
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...
EUVD-2026-76803
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...
CVE-2026-87892
The Rox Appointment Booking WordPress plugin (versions before 1.2.0 ) fails to verify the order total or selected payment method against its own server-side pricing when creating a booking. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass the sit...
CVE-2026-77689 Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...
CVE-2026-77689
Amelia Pro (Booking for Appointments and Events Calendar) WordPress plugin, versions 9.0 through 9.8, fails to verify that a payment was actually collected before recording a booking as paid. The plugin trusts the payment gateway named in a public, unauthenticated booking request, even when the s...
EUVD-2026-76813
The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway...