CVE-2026-84169

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

CVE-2026-84169

The UPI QR Code Payment Gateway WordPress plugin (version 1.4.3 and earlier ) is vulnerable to an unauthenticated cross-order payment-status forgery . The root cause is a failure to verify that a payment-confirmation request correctly matches the associated order and customer. This allows an unau...

CVE-2026-84169 UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment...

CVE-2026-105225

A code injection vulnerability exists in osCommerce osCommerce2 versions up to 2.3.4.1 . The flaw resides in the Payment Page component, specifically within the include function of the includes/classes/payment.php file. Attackers can achieve remote code execution by manipulating the MODULE_PAYMEN...

Gpt-Agreement-Payment

简体中文 | English Gpt-Agreement-Payment Herramienta de reproducción de extremo a extremo del protocolo de suscripción ChatGPT Plus / Team: desde la captura de paquetes hasta invertir toda la cadena Stripe Checkout → PayPal / GoPay / QRIS → ChatGPT manual-approval → Codex OAuth + PKCE, e implementarl...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Publicado : 26 de junio de 2026 Última actualización : 27 de junio de 2026 Investigador : Netwurm - VTDR e.V.i.G. Descripción de la Vulnerabilidad El plugin WP Full Stripe Free para WordPress es vulnerable a Autorización Faltante en versiones hasta, e...

CVE-2025-22652

CVE-2025-22652 1️⃣ Tipo de componente Plugin de WordPress 2️⃣ Detalles del componente Nombre del componente Payment Forms for Paystack Versión vulnerable = 4.0.1 Slug del componente payment-forms-for-paystack Enlace del componente https://wordpress.org/plugins/payment-forms-for-paystack/ 3️⃣ OWASP...

CVE-2024-21514

CVE-2024-21514 PoC y Escáner Masivo Resumen POC para CVE-2024-21514 : Se identificó un problema de inyección SQL en la extensión de pago Divido para OpenCart, que está incluida por defecto en la versión 3.0.3.9 Este POC fue creado por M Ali y está basado en este Aviso de Seguridad de Snyk. Cómo...

EUVD-2026-92121

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2020-28415

CVE-2020-28415 Descripción sugerida Existe una vulnerabilidad de cross-site scripting XSS reflejado en TranzWare Payment Gateway 3.1.12.3.2. Un atacante remoto no autenticado puede ejecutar código HTML arbitrario mediante una URL manipulada un vector diferente al de CVE-2020-28414. Tipo de...

CVE-2020-28414

CVE-2020-28414 Descripción sugerida Existe una vulnerabilidad de Cross-Site Scripting XSS reflejado en TranzWare Payment Gateway 3.1.12.3.2. Un atacante remoto no autenticado puede ejecutar código HTML arbitrario mediante una URL manipulada. Tipo de vulnerabilidad Cross-Site Scripting XSS Vendedo...

cve-2026-67363-67364

Balbooa Forms pre-auth RCE + Payment Tampering CVE-2026-67364 / CVE-2026-67363 PoC and detection templates for two pre-auth vulnerabilities in Balbooa Forms combaforms for Joomla, fixed in 2.4.3.2. CVE-2026-67364 — Pre-auth PHP Code Injection - RCE CVSS 9.8 CVE-2026-67363 — Pre-auth Payment Amoun...

PayPlus Payment Gateway < 6.6.9 - SQL Injection

The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability. id: CVE-2024-6205 info: name: PayPlus Payment...

SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id

The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The createpaymentintent AJAX handler checks if $formid 0 && !empty$blockid before calling validatepaymentamount. By sending formid=0 the default intval of a missing/zero...

Code-Projects School Fees Payment System 1.0 - SQL Injection

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been...

Payment Gateway for Telcell < 2.0.4 - Open Redirect

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue id: CVE-2023-6786 info: name: Payment Gateway for Telcell 2.0.4 - Open Redirect author: s4e-io severity: medium description: | The plugin does not validate the apiurl...

WordPress PhonePe Payment Solutions <=1.0.15 - Server-Side Request Forgery

WordPress PhonePe Payment Solutions plugin through 1.0.15 is susceptible to server-side request forgery. An attacker can cause a website to execute website requests to an arbitrary domain, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized...

stylesmuggler

StyleSmuggler HTTP PoC StyleSmuggler、CVE-2026-75650 をローカルの Magento Open Source ラボに対して HTTP のみで再現するためのプライベート研究リポジトリです。 完全な技術解説は Magento StyleSmuggler RCE: Report Poisoning to Code Execution をお読みください。 この Python PoC は、認証不要の一連の処理を完全に実行します: 1. Magento のエラーレポートをポイズニングし、レスポンスからそのレポート ID を読み取る; 2...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::createorderfortransaction action registered as a public unauthenticate...

CVE-2026-94432

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 5.7.1 . The flaw exists in the OsPaypalConnectController::create_order_for_transaction() action, which is exposed as an unauthenticated route via wp...