7648 matches found
WordPress WP Hotel Booking plugin < 2.3.2 - Unauthenticated PayPal Payment Bypass vulnerability
Unauthenticated PayPal Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Hotel Booking versions 2.3.2...
WordPress WP Hotel Booking plugin < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation vulnerability
Unauthenticated Payment Bypass via Price Manipulation vulnerability discovered by reconnaissance in WordPress Plugin WP Hotel Booking versions 2.3.3...
WordPress Simple Membership plugin < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification vulnerability
Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Simple Membership versions 4.7.7...
WordPress Events Made Easy plugin < 3.1.2 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Haitam Lazaar in WordPress Plugin Events Made Easy versions 3.1.2...
CVE-2026-18323: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-18328: Improper Neutralization of Input During Web Page Generation
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...
CVE-2026-71507
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...
CVE-2026-71506
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...
CVE-2026-71507
Dolibarr before 24.0.0 is affected by a broken object-level authorization flaw in the REST API company bank account write routes. An authenticated user holding only third-party creation rights can create, replace, or delete bank account details of any company without needing read access to that c...
CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...
EUVD-2026-65080
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...
CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...
CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...
CVE-2026-71506 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...
CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...
CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients
The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...
WordPress Charitable plugin < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability
Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Charitable versions 1.8.12...
WordPress myCred plugin < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED vulnerability
Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin myCred versions 3.2.5...
Malicious Package
Overview sm-payment is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
