Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure

The plugin does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerabilit...

Amelia < 1.0.48 - Customer+ SMS Service Abuse and Sensitive Data Disclosure

The plugin does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS notification as well as retrieve sensitive information about the admin, such as the email, account balance and payment history. A malicious actor can abuse this vulnerabilit...

Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods

Description 1 Checkout URL and Custom order id parameters are vulnerable to stored XSS, which are located in Shop Settings other settings Advanced 2 From e-mail address and From name parameters are vulnerable to stored XSS, which are located in Shop Settings Autorespond E-mail settings check your...

UBUNTU-CVE-2022-26661

An XXE issue was discovered in Tryton Application Platform Server 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform Command Line Client proteus 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user...

Extortion scheme impersonates government officials, law enforcement

The FBI issued a public warning this week about a fraud scheme wherein scammers impersonate government officials and law enforcement personnel. According to the PSA, the scammers spoof legitimate numbers and names and use fake credentials of well-known members of the government and law enforcemen...

WooCommerce < 6.3.1 - Orders Marked as Paid (via PayPal Standard Gateway)

The PayPal Standard payment gateway deprecated since July 2021 of the plugin could allow attackers to mark an order as paid without actually making a payment, when PDT is enabled...

Kraden: Business Logic Flaw in the subscription of the app

Summary: Hello Security Team Business logic vulnerabilities are flaws in the design and implementation of an application that allow an attacker to elicit unintended behavior. This potentially enables attackers to manipulate legitimate functionality to achieve a malicious goal. Steps To Reproduce:...

Wordline HIDCCEMonitorSVC code issue vulnerability

Wordline HIDCCEMonitorSVC is a secure payment and trusted transaction domain application from the French company Wordline.A code issue vulnerability exists in Wordline HIDCCEMonitorSVC, which stems from the fact that Wordline HIDCCEMonitorSVC contains an unquoted service path, which can be...

Wordline HIDCCEMonitorSVC 代码问题漏洞

Wordline HIDCCEMonitorSVC is a secure payment and trusted transaction domain application from the French company Wordline.A code issue vulnerability exists in Wordline HIDCCEMonitorSVC, which stems from the fact that Wordline HIDCCEMonitorSVC contains an unquoted service path, which can be...

[WP-H7] In some cases, when acceptOffer(), the buyer's ETH payment will be sent to the seller but the NFT will not be transferred to the buyer (paid and get nothing in return)

Lines of code Vulnerability details PoC Case A: Given: A ReserveAuction is waiting to be finalized: the creator createReserveAuction the bidder bid with 1 ETH wait until auction.endTime When: buyer makeOffer with: 1 ETH bidder acceptOffer Expected Results: 1. creator to receive bidder's payment o...

WordPress Payment Page plugin <= 1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Payment Page plugin versions = 1.1. Solution Update the WordPress Payment Page plugin to the latest available version at least 1.1.1...

WordPress Choice Payment Gateway for WooCommerce plugin <= 2.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Choice Payment Gateway for WooCommerce plugin versions = 2.0.1. Solution Update the WordPress Choice Payment Gateway for WooCommerce plugin to the latest available version at least 2.0.2...

WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin < 3.1.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin versions 3.1.6. Solution Update the WordPress Dreamfox Media Payment gateway per Product for Woocommerce plugin to the latest available version at least 3.1.6...

WordPress Payment Gateway for PayFabric plugin <= 1.0.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Payment Gateway for PayFabric plugin versions = 1.0.5. Solution Update the WordPress Payment Gateway for PayFabric plugin to the latest available version at least 1.0.12...

WordPress Authorize.Net Payment Gateway For WooCommerce plugin < 5.1.27 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Authorize.Net Payment Gateway For WooCommerce plugin versions 5.1.27. Solution Update the WordPress Authorize.Net Payment Gateway For WooCommerce plugin to the latest available version at least 5.1.27...

WordPress RecurWP – WordPress Recurly Payment Gateway plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RecurWP – WordPress Recurly Payment Gateway plugin versions = 1.0.1. Solution No patched version available...

WordPress WC Place Order Without Payment plugin <= 2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WC Place Order Without Payment plugin versions = 2.1. Solution Update the WordPress WC Place Order Without Payment plugin to the latest available version at least 2.2...

WordPress WordPress Stripe Donation and Payment Plugin plugin < 2.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress Stripe Donation and Payment Plugin plugin versions 2.9. Solution Update the WordPress WordPress Stripe Donation and Payment Plugin plugin to the latest available version at least 2.9...

WordPress Payment Page plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Payment Page plugin versions = 1.1. Solution Update the WordPress Payment Page plugin to the latest available version at least 1.1.1...

WordPress Ether and ERC20 tokens WooCommerce Payment Gateway plugin <= 4.12.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ether and ERC20 tokens WooCommerce Payment Gateway plugin versions = 4.12.8. Solution Update the WordPress Ether and ERC20 tokens WooCommerce Payment Gateway plugin to the latest available version at least 4.12.9...