WordPress Plugin PayPal Checkout Payment Gateway 1.6.8 - Parameter Tampering

Exploit Title: cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price Date: 27.01.2019 Product Title :Woocommer...

Code injection

DISPUTED cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that...

CVE-2019-7441

CVE-2019-7441 affects the WordPress plugin WooCommerce PayPal Checkout Payment Gateway version 1.6.8. The vulnerability is Parameter Tampering in the /cgi-bin/webscr?cmd=_cart endpoint, where an attacker can manipulate the amount (e.g., amount_1) to pay less than the intended price. The public de...

WordPress WooCommerce GloBee Payment Gateway 1.1.1 Bypass / Spoofing

?php Exploit Title: WordPress WooCommerce - GloBee cryptocurrency Payment Gateway Plugin Payment Bypass / Unauthorized Order Status Spoofing Discovery Date: 14.12.2018 Public Disclosure Date: 14.02.2019 Exploit Author: GeekHack Contact: https://t.me/GeekHack Vendor Homepage: https://globee.com/...

WordPress Plugin WooCommerce - GloBee (cryptocurrency) Payment Gateway 1.1.1 - Payment Bypass Unauthorized Order Status Spoofing

WordPress Plugin WooCommerce - GloBee cryptocurrency Payment Gateway 1.1.1 - Payment Bypass Unauthorized Order Status Spoofing ?php Exploit Title: WordPress WooCommerce - GloBee cryptocurrency Payment Gateway Plugin Payment Bypass / Unauthorized Order Status Spoofing Discovery Date: 14.12.2018...

WordPress Plugin WooCommerce - GloBee (cryptocurrency) Payment Gateway 1.1.1 - Payment Bypass / Unauthorized Order Status Spoofing

?php Exploit Title: WordPress WooCommerce - GloBee cryptocurrency Payment Gateway Plugin Payment Bypass / Unauthorized Order Status Spoofing Discovery Date: 14.12.2018 Public Disclosure Date: 14.02.2019 Exploit Author: GeekHack Contact: https://t.me/GeekHack Vendor Homepage: https://globee.com/...

Ispirithalaya Hospital Management System 0.1.2 Database Configuration Disclosure

Exploit Title : Ispirithalaya Hospital Management System 0.1.2 Database Config Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 14/02/2019 Vendor Homepage : freeehospital.com Software Download Link :...

CVE-2018-19189

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement...

Code injection

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement...

Code injection

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter...

CVE-2018-19188

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fortid parameter...

CVE-2018-19186

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter...

CVE-2018-19190

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php errormsg parameter...

Code injection

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fortid parameter...

CVE-2018-19187

The CVE-2018-19187 entry concerns the Amazon PAYFORT payfort-php-SDK (payment gateway SDK) with an XSS flaw present through 2018-04-26. The root cause is mishandling of an arbitrary parameter name or value in a success.php echo statement, enabling cross-site scripting. Documents identify the affe...

CVE-2018-19190

The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php errormsg parameter...

CVE-2018-19189

The CVE-2018-19189 entry concerns the Amazon PAYFORT payfort-php-SDK (up to 2018-04-26) and a cross-site scripting (XSS) condition caused by mishandling an arbitrary parameter name or value in an error.php echo statement. The vulnerability is described in the NVD entry as an XSS risk with a CVSS ...

CVE-2018-19186

CVE-2018-19186 concerns the Amazon PAYFORT payfort-php-SDK (payment gateway SDK) through 2018-04-26, where a cross-site scripting (XSS) flaw exists in the route.php paymentMethod parameter. The vulnerability is evidenced in NVD and corroborated by multiple sources (CNVD/CVE records). Affected com...

CVE-2018-19188

The CVE-2018-19188 entry concerns the Amazon PAYFORT payfort-php-SDK (pre-2018-04-26) with an XSS flaw exploitable through the success.php fort_id parameter. Connected records (NVD, CVE List, CNVD, PRION, CVELIST) corroborate the same description. The documents do not provide explicit remediation...

CVE-2018-19190

The CVE-2018-19190 entry concerns the Amazon PAYFORT payfort-php-SDK payment gateway, with an XSS vulnerability exploitable via the error.php error_msg parameter in versions up to 2018-04-26. The NVD notes CVSS v2 base score 4.3 (Medium) and CVSS v3.0 base score 6.1 (Medium). Exploitation details...