CVE-2025-13748 Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.1.7 via the 'submissionid' parameter due to missing validation on a user controlled key within...

PHP Scripts Mall Amazon Affiliate Store Input Validation Error Vulnerability

PHP Scripts Mall Amazon Affiliate Store is an online e-store system by PHP Scripts Mall India. An input validation error vulnerability exists in PHP Scripts Mall Amazon Affiliate Store version 2.1.6, which can be exploited by attackers to tamper with payment amounts...

CVE-2019-9864

PHP Scripts Mall Amazon Affiliate Store 2.1.6 allows Parameter Tampering of the payment amount...

CVE-2019-7441

cgi-bin/webscr?cmd=cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter such as amount1, as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amou...

CVE-2019-9065

PHP Scripts Mall Custom T-Shirt Ecommerce Script 3.1.1 allows parameter tampering of the payment amount...

CVE-2019-9063

PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount...

CVE-2019-9063

PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount...

CVE-2019-9065

PHP Scripts Mall Custom T-Shirt Ecommerce Script 3.1.1 allows parameter tampering of the payment amount...

CVE-2019-9063

PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount...

Multiple Vulnerabilities in UZONE App

UZONE APP is a shopping application based on the UZONE product platform. An SMS bomb and logic design vulnerability exists in UZONE APP. The vulnerability is due to the number of SMS verification sends in the service side is not verified due to the attacker can be any cell phone number SMS attack...