CVE-2018-19186

CVE-2018-19186 concerns the Amazon PAYFORT payfort-php-SDK (payment gateway SDK) through 2018-04-26, where a cross-site scripting (XSS) flaw exists in the route.php paymentMethod parameter. The vulnerability is evidenced in NVD and corroborated by multiple sources (CNVD/CVE records). Affected com...

CVE-2018-19188

The CVE-2018-19188 entry concerns the Amazon PAYFORT payfort-php-SDK (pre-2018-04-26) with an XSS flaw exploitable through the success.php fort_id parameter. Connected records (NVD, CVE List, CNVD, PRION, CVELIST) corroborate the same description. The documents do not provide explicit remediation...

CVE-2018-19190

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php errormsg parameter...

GoUrl Bitcoin Payment Gateway < 1.4.14 - Shell Upload

The GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership WordPress plugin was affected by a Shell Upload security vulnerability...

EC-CUBE Payment Module and GMO-PG Payment Module Cross-Site Scripting Vulnerabilities

LOCKON EC-CUBE is an open source e-commerce website building platform developed by LOCKON Japan. The platform supports product login, user evaluation, art layout, etc. EC-CUBE Payment Module and GMO-PG Payment Module are payment modules developed by Japan GMO Payment Gateway Company which are use...

EC-CUBE Payment Module and GMO-PG Payment Module Input Validation Vulnerability

LOCKON EC-CUBE is an open source e-commerce website building platform developed by LOCKON Japan. The platform supports product login, user evaluation, art layout, etc. EC-CUBE Payment Module and GMO-PG Payment Module are payment modules developed by Japan GMO Payment Gateway Company which are use...

Multiple vulnerabilities in EC-CUBE Payment Module and GMO-PG Payment Module (PG Multi-Payment Service) for EC-CUBE

Overview EC-CUBE Payment Module and GMO-PG Payment Module PG Multi-Payment Service, which are additional modules for EC-CUBE, provided by GMO Payment Gateway, Inc. contain multiple vulnerabilities listed below. Cross-site scripting vulnerability in the management screen CWE-79 - CVE-2018-0657 Inp...

eWallet Online Payment Gateway 2 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/ewallet-online-payment-gateway/19316332?srank=1110 Version: 2 Tested on: Kali linux POC : eWallet ...

eWallet Online Payment Gateway 2 Cross Site Request Forgery

Exploit Title: eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/ewallet-online-payment-gateway/19316332?srank=1110 Version: 2 Tested on: Kali linux POC : eWallet - Online Payment Gateway 2 suffers fr...

eWallet Online Payment Gateway 2 - Cross-Site Request Forgery

eWallet Online Payment Gateway 2 - Cross-Site Request Forgery Exploit Title: eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/ewallet-online-payment-gateway/19316332?srank=1110 Version: 2 Tested on:...

eWallet Online Payment Gateway 2 - Cross-Site Request Forgery

Exploit Title: eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery Date: 2018-05-23 Exploit Author: L0RD Vendor Homepage: https://codecanyon.net/item/ewallet-online-payment-gateway/19316332?srank=1110 Version: 2 Tested on: Kali linux POC : eWallet - Online Payment Gateway 2 suffers fr...

paymentgatewayonline.info XSS vulnerability

Vulnerable URL: http://paymentgatewayonline.info/sploit/view.php?where=%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 23.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

barrecertification.com XSS vulnerability

Open Bug Bounty ID: OBB-279869 Description| Value ---|--- Affected Website:| barrecertification.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI (cavv parameter). Root cause: unsanitized input echoed in the response, enabling injection of arbitrary scripts. Impact per provi...

CVE-2017-7992

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

CVE-2017-7992: Improper Neutralization of Input During Web Page Generation

Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php v2.8.17 is vulnerable to a reflected XSS in examples/consumer-authentication/cruise.php via the URI, as demonstrated by the cavv parameter...

PT-2017-18054

Name of the Vulnerable Software and Affected Versions Heartland Payment Systems Payment Gateway PHP SDK hps/heartland-php version 2.8.17 Description The issue concerns a reflected XSS in the examples/consumer-authentication/cruise.php file via the URI. Specifically, the cavv parameter is vulnerab...

fttsecurepaymentgateway.com XSS vulnerability

Vulnerable URL: https://www.fttsecurepaymentgateway.com/TradingWeb/joinWelcomeInit.action?urlSource=CTT'"--!confirmOPENBUGBOUNTY...

iTechScripts Payment Gateway Script 8.46 SQL Injection

Exploit Title : Payment Gateway Script v8.46 - Multiple Vulnerability Author : Hasan Emre Ozer Google Dork : - Date : 18/01/2017 Type : webapps Platform: PHP Vendor Homepage : http://itechscripts.com/payment-gateway-script/ Sofware Price and Demo : $400 http://payment-gateway.itechscripts.com...

‘One-Stop Shop’ – Phishing Domain Targets Information from Customers of Several Indian Banks

FireEye Labs recently discovered a malicious phishing domain designed to steal a variety of information – including credentials and mobile numbers – from customers of several banks in India. Currently, we have not observed this domain being used in any campaigns. The phishing websites appear to b...