256 matches found
By-Poloss..-..CVE-2026-12432-PoC
CVE-2026-12432: WP Full Stripe Free = 8.4.4 Published : June 26, 2026 Last Updated : June 27, 2026 Researcher : Netwurm - VTDR e.V.i.G. Vulnerability Description The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the...
CVE-2026-126742
The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems. The module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status...
DRUPAL-CONTRIB-2026-333
The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems. The module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status...
PT-2026-145658
The Commerce sermpea module provides Commerce support for Spanish banks that use Sermepa/Redsys systems. The module does not verify that a Redsys payment response belongs to the order it is processed for, which can lead to incorrect order payment status...
CVE-2026-101275
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...
CVE-2026-101275 Insufficient validation of payment status in pretix-adyen
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...
CVE-2026-101275
The pretix-adyen payment integration contains a vulnerability due to insufficient validation of payment status responses from Adyen. An attacker can exploit this by reusing a successful payment status response from a single transaction to authorize multiple different payments, potentially gaining...
CVE-2026-101275
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...
CVE-2026-101275 Insufficient validation of payment status in pretix-adyen
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...
EUVD-2026-120896
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...
CVE-2026-101275: pretix pretix-adyen: Our payment integration with Adyen did not properly validate payment status responses
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...
PT-2026-141587
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment...
PT-2026-137298
This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are i...
CVE-2026-94361
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...
EUVD-2026-114590
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...
CVE-2026-94361: Unknown Payable Payment Gateway for WooCommerce: The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an…
The Payable Payment Gateway for WooCommerce WordPress plugin before 1.3.1 does not verify the authenticity of an incoming payment notification before marking a WooCommerce order paid or failed, allowing unauthenticated attackers to change the payment status of any order in the store regardless of...
PT-2026-134435
Name of the Vulnerable Software and Affected Versions Payable Payment Gateway for WooCommerce WordPress plugin versions prior to 1.3.1 Description The plugin fails to verify the authenticity of incoming payment notifications before updating the status of a WooCommerce order to paid or failed. Thi...
CVE-2026-119422
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...
CVE-2026-119422
Juspay Hyperswitch before version 1.128.0 is vulnerable to an authentication bypass in the Worldpayxml connector . The root cause is that the verify_webhook_source function always returns true without enforcing mTLS , allowing unauthenticated attackers to forge payment status updates. By providin...
EUVD-2026-113802
Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment status updates because the Worldpayxml connector's verifywebhooksource always returns true without enforced mTLS. Attackers knowing the merchantid and Worldpay...