CVE-2025-61148

CVE-2025-61148 The vulnerability exists in the Student Payment API. The application fails to properly validate whether the user requesting a receipt is authorized to view it. By modifying the recno parameter in the API request, an attacker can access the receipts of other users. CVE-2025-61148:...

CVE-2026-84918

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3...

CVE-2026-84918 Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3...

CVE-2026-84918

The Drupal Monobank payment API module (versions 0.0.0 through 1.0.3 ) contains an Improper Verification of Cryptographic Signature vulnerability. The root cause is the module's failure to verify the cryptographic signature of webhooks before processing payment status callbacks. This flaw allows ...

CVE-2026-84918 Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3...

CVE-2026-84918 Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3...

CVE-2026-84918

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3...

EUVD-2026-107869

Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3...

Drupal Monobank payment API encryption issue vulnerability

The Drupal Monobank payment API versions prior to 0.0.0 and 1.0.3 contain an encryption-related vulnerability. This vulnerability stems from improper validation of encrypted signatures, potentially allowing signature forgery...

CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

DRUPAL-CONTRIB-2026-130

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks...

PT-2026-84894

Name of the Vulnerable Software and Affected Versions Drupal Monobank payment API versions 0.0.0 through 1.0.3 Description The Monobank payment API module, used for integrating Monobank acquiring payments, fails to verify the cryptographic signature of webhooks before processing payment status...

Monobank payment API - Moderately critical - Access bypass - SA-CONTRIB-2026-130

The Monobank payment API module provides integration with Monobank acquiring payments. The module did not verify the Monobank webhook signature before processing payment status callbacks...

VulnCheck KEV: CVE-2026-31843

The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...

CVE-2026-31843

The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...

CVE-2026-31843 goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution

The goodoneuz/pay-uz Laravel package = 2.2.24 contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remot...

CVE-2025-61148

An Insecure Direct Object Reference IDOR vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'recno' parameter in the /student/get-receipt endpoint...

EUVD-2025-201238

Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors...

CVE-2025-61148: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students personal and financial records by modifying the 'recno' parameter in the /student/get-receipt endpoint...