60 matches found
CVE-2026-96200
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...
CVE-2026-96173
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...
EUVD-2026-90519
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...
CVE-2026-96200
The Payments for Hubtel WordPress plugin (versions before 1.0.2 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify that payment notifications received via the plugin's payment callback actually originate from the legitimate payment provider....
EUVD-2026-90518
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and view its contents...
CVE-2026-96200 Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without payment...
CVE-2026-97324
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...
EUVD-2026-86409
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...
CVE-2026-97324
The YunaiV/zhijiantianya ruoyi-vue-pro application (up to version 2026.08) is vulnerable to improper authorization in the Demo-order Payment Callback Handler component. Specifically, the updateDemoOrderPaid function in yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/de...
CVE-2026-97324 YunaiV/zhijiantianya ruoyi-vue-pro Demo-order Payment Callback PayDemoOrderController.java updateDemoOrderPaid improper authorization
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...
CVE-2026-97324: Improper Authorization
A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...
PT-2026-98260
Name of the Vulnerable Software and Affected Versions YunaiV/zhijiantianya ruoyi-vue-pro versions prior to 2026.09 Description Improper authorization exists in the Demo-order Payment Callback Handler component. A remote attacker can manipulate the ID argument within the updateDemoOrderPaid functi...
CVE-2026-90923
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
CVE-2026-90923
The Autopay WordPress plugin (versions before 5.0.1 ) is vulnerable to an incorrect authorization flaw because it fails to enforce signatures on specific payment callbacks. This security weakness allows unauthenticated users to perform cross-customer actions, specifically the disclosure and delet...
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
CVE-2026-90923 Autopay < 5.0.1 - Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
EUVD-2026-81350
The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders...
CVE-2026-86809 Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
CVE-2026-86809 Persian Elementor < 2.8.2 - Unauthenticated ZarinPal Payment Callback Authority Bypass
The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the payment authority returned to its ZarinPal payment callback belongs to the transaction being completed, allowing unauthenticated attackers to complete a pending order using a valid payment authority obtained...
