697 matches found
CVE-2020-28415
CVE-2020-28415 提案された説明 TranzWare Payment Gateway 3.1.12.3.2 には、反映型クロスサイトスクリプティング（XSS）の脆弱性が存在します。リモートの未認証の攻撃者は、細工された URL を介して任意の HTML コードを実行することが可能です（CVE-2020-28414 とは異なるベクトル）。 脆弱性タイプ クロスサイトスクリプティング（XSS） 製品ベンダー TranzWare 影響を受ける製品コードベース Payment Gateway 3.1.12.3.2 攻撃タイプ リモート コード実行の影響 true...
WordPress ePayco Payment Gateway for WooCommerce plugin < 8.4.7 - Unauthenticated Payment Confirmation Bypass vulnerability
Unauthenticated Payment Confirmation Bypass vulnerability discovered by Pedro Pinho in WordPress Plugin Epayco versions 8.4.7...
CVE-2026-84043
The ePayco Payment Gateway for WooCommerce WordPress plugin, in versions before 8.4.7 , fails to properly verify the authenticity of payment confirmation requests. This allows unauthenticated attackers to mark orders as paid without presenting a valid gateway signature, resulting in a low integri...
EUVD-2026-70991
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...
Payment Gateway for Telcell < 2.0.4 - Open Redirect
The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...
CVE-2020-28414
CVE-2020-28414 建议描述 TranzWare Payment Gateway 3.1.12.3.2 存在一个反射型跨站脚本（XSS）漏洞。远程未认证攻击者可通过精心构造的 URL 执行任意 HTML 代码。 漏洞类型 跨站脚本（XSS） 供应商产品 TranzWare 受影响产品代码库 Payment Gateway 3.1.12.3.2 攻击类型 远程 影响代码执行 是 供应商是否已确认或承认该漏洞？ 是 参考 https://compassplus.com/solutions/tranzware/ 发现者 Vladimir Rotanov（Jet Infosystems...
EUVD-2026-68992
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...
CVE-2026-13611
The KiviCare WordPress plugin (a Clinic & Patient Management System / EHR) prior to version 4.5.5 is missing authorization checks on certain REST endpoints , enabling unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...
CVE-2026-13611 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...
EUVD-2026-68044
The Total processing card payments for WooCommerce WordPress plugin through 7.3 does not validate a user-supplied path before using it to build a server-side verification request, and does not verify the authenticity of the response, allowing unauthenticated attackers to redirect that request to ...
DRUPAL-CONTRIB-2026-106
This module integrates Drupal Commerce with the CyberSource payment gateway. The module does not correctly verify the integrity of data returned by the payment provider. A timing attack could allow an attacker to trick the site into registering that payment has been received even if it hasn't. Th...
CVE-2026-16738
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...
CVE-2026-16738 Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...
CVE-2026-16738
The Conekta Payment Gateway WordPress plugin (versions before 6.2.2 ) fails to verify the authenticity of incoming payment gateway webhook notifications and does not bind the confirmed payment to the targeted order or validate its amount. This allows unauthenticated attackers to forge webhook req...
EUVD-2026-64218
The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway webhook notifications, nor bind the confirmed payment to the targeted order or verify its amount, allowing unauthenticated attackers to mark arbitrary orders as paid without...
CVE-2026-15150
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...
EUVD-2026-63909
The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a...
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...