PT-2025-16024 · Unknown · Codelit Courselit

Name of the Vulnerable Software and Affected Versions: CodeLit CourseLit versions prior to 0.57.5 Description: The issue allows Parameter Tampering via a payment plan associated with the wrong entity. Recommendations: For versions prior to 0.57.5, update to version 0.57.5 or later to resolve the...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 is affected. The issue is parameter tampering via a payment plan associated with the wrong entity, caused by the payment plan association logic. Impact is described as low (CVSS 3.1: AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N). Exploitation details are not provided in the...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

CVE-2025-32816

CodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the wrong entity...

China-based SMS Phishing Triad Pivots to Banks

China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from Apple and Google. Until recently, the so-called "Smishing Triad " mainly impersonated toll road operators and shipping companies. But experts say these groups a...

Unraveling the U.S. toll road smishing scams

Cisco Talos has observed a widespread and ongoing financial theft SMS phishing smishing campaign since October 2024 that targets toll road users in the United States of America. We observed that the campaign targets people across several states in the U.S. according to the domain names used in th...

WordPress plugin Payment Forms for Paystack 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Payment Forms for Paystack plugin <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Payment Forms for Paystack versions = 4.0.2...

CVE-2025-3342

A vulnerability has been found in codeprojects Online Restaurant Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/paymentsave.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The...

WordPress Total processing card payments for WooCommerce Plugin <= 7.1.5 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by LVT-tholv2k in WordPress Plugin Nomupay Payment Processing Gateway versions = 7.1.5...

CVE-2025-3331

A vulnerability, which was classified as critical, has been found in codeprojects Online Restaurant Management System 1.0. This issue affects some unknown processing of the file /paymentsave.php. The manipulation of the argument mode leads to sql injection. The attack may be initiated remotely. T...

Online Restaurant Management System 安全漏洞

Online Restaurant Management System is a Code-projects open source online restaurant management system. A security vulnerability exists in Online Restaurant Management System version 1.0, which originates from improper handling of the parameter ID in the /admin/paymentsave.php file, which may lea...

Online Restaurant Management System SQL注入漏洞

Online Restaurant Management System is a Code-projects open source online restaurant management system. A SQL injection vulnerability exists in Online Restaurant Management System version 1.0, which originates from improper handling of the parameter mode in the /paymentsave.php file, which may le...

Legacy Stripe API Exploited to Validate Stolen Payment Cards in Web Skimmer Campaign

Threat hunters are warning of a sophisticated web skimmer campaign that leverages a legacy application programming interface API from payment processor Stripe to validate stolen payment information prior to exfiltration. "This tactic ensures that only valid card data is sent to the attackers,...

CVE-2025-22640

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through = 2.3.3...

CVE-2025-22652

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in kendysond Payment Forms for Paystack payment-forms-for-paystack allows SQL Injection.This issue affects Payment Forms for Paystack: from n/a through = 4.0.1...

CVE-2025-30900

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zoho Subscriptions Zoho Billing – Embed Payment Form allows Stored XSS. This issue affects Zoho Billing – Embed Payment Form: from n/a through 4.0...

CVE-2025-26541

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerce woo-altcoin-payment-gateway allows Reflected XSS.This issue affects Bitcoin / AltCoin Payment Gateway for WooCommerce: from n/a through =...

WordPress Rapyd Payment Extension for WooCommerce plugin <= 1.2.0 - PHP Object Injection Vulnerability

PHP Object Injection Vulnerability discovered by astra.r3verii in WordPress Plugin Rapyd Payment Extension for WooCommerce versions = 1.2.0...