7957 matches found
CVE-2025-7638: Improper Neutralization of Special Elements used in an SQL Command
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 1.45.0 due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2025-3780
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfmredirecttosetup function in all versions up to, and including, 6.7.16. This makes i...
PT-2025-28802 · WordPress · Wcfm – Frontend Manager For Woocommerce +1
Name of the Vulnerable Software and Affected Versions: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress versions up to and including 6.7.16 Description: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription...
BoyunCMS security vulnerabilities
BoyunCMS is an enterprise content management system from China Boyun Boyun Company. A security vulnerability exists in BoyunCMS 1.4.20 and earlier versions, which originates from improper handling of the component curl in the file /application/pay/controller/Index.php, which may lead to server-si...
CVE-2025-50032 WordPress Paytiko for WooCommerce <= 1.3.14 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paytiko for WooCommerce: from n/a through 1.3.14...
CVE-2025-6464: Deserialization of Untrusted Data
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entrydeleteuploadfiles' function. This makes it possible for unauthenticat...
Campcodes Sales and Inventory System Security Vulnerabilities
CampCodes Sales and Inventory System is a sales and inventory system from CampCodes, Inc. A security vulnerability exists in Campcodes Sales and Inventory System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter cid in the file /pages/paymentadd.php...
PT-2025-27484 · Unknown · Campcodes Sales/Inventory System
Name of the Vulnerable Software and Affected Versions: Campcodes Sales and Inventory System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file "/pages/payment add.php". The manipulation of the cid argument leads to SQL injection. Th...
Inventory Management System editPayment.php File SQL Injection Vulnerability
Inventory Management System is an inventory management system. Inventory Management System has a SQL injection vulnerability that stems from insufficient filtering of the orderId parameter in the file /phpaction/editPayment.php. No details of the vulnerability are available at this time...
CVE-2025-53295
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through = 2.0.7...
CVE-2025-6688
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...
CVE-2025-6834
A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /phpaction/editPayment.php. The manipulation of the argument orderId leads to sql injection. The attack can be initiated remotely. The...
PT-2025-27302 · Undefined · Undefined
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns an authentication bypass in an online payment processing system. No further details are available regarding the technical aspects of the issue, such as API endpoints,...
CVE-2025-53295
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through = 2.0.7...
CVE-2025-53295 WordPress iCount Payment Gateway plugin <= 2.0.7 - Broken Access Control Vulnerability
Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through = 2.0.7...
CVE-2025-53295 WordPress iCount Payment Gateway plugin <= 2.0.6 - Broken Access Control Vulnerability
Missing Authorization vulnerability in iCount iCount Payment Gateway allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects iCount Payment Gateway: from n/a through 2.0.6...
CVE-2025-53295
CVE-2025-53295 concerns iCount Payment Gateway <= 2.0.6 with a Missing Authorization issue allowing access to constrained functionality. The provided data shows CVSS v3.1 base score 5.3 (Medium) and an unauthenticated/unauthorized access risk. Patch guidance appears in Patchstack: iCount Payme...
CVE-2025-6688
CVE-2025-6688 (Simple Payment, WordPress) : Affects WordPress Simple Payment plugin versions 1.3.6–2.3.8. Root cause: login flow does not properly verify a user’s identity before using create_user(), enabling an unauthenticated attacker to log in as an administrator. Impact: Authentication bypass...
CVE-2025-6688 Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...
CVE-2025-6688 Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin
The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...