7650 matches found
CVE-2026-67363
The stripeCharges and payAuthorize endpoints in Balbooa Forms (versions before 2.4.3.2) accept the charge total from a client-controlled parameter without recomputing it from configured prices and lack authentication or CSRF checks. An unauthenticated attacker can purchase priced items for arbitr...
CVE-2026-18779 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...
CVE-2026-18779
The TrueBooker WordPress plugin (versions before 1.2.7 ) contains a vulnerability due to missing authorization checks in an AJAX action, specifically the update_appointment_booked function. This flaw allows unauthenticated users to delete arbitrary appointment records, including associated bookin...
CVE-2026-18779 TrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...
CVE-2026-18031 TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...
CVE-2026-18031
The TabaPay Gateway WordPress plugin (versions
PT-2026-78352
Name of the Vulnerable Software and Affected Versions Balbooa Forms versions prior to 2.4.3.2 Description An issue exists where the 'stripeCharges' and 'payAuthorize' endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without...
CVE-2026-67363: External Control of Assumed-Immutable Web Parameter
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured...
PT-2026-78298
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records...
PT-2026-78290
The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator...
PT-2026-78539
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
CVE-2026-73829: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use TOCTOU Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against replay with a non-atomic check-then-mar...
Malicious code in agora402-payment-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...
MAL-2026-14136 Malicious code in agora402-payment-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
GO-2026-6245 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging in github.com/QuantumNous/new-api...
CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...
EUVD-2026-60817
Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...
CVE-2026-74009
The WordPress Razorpay for WooCommerce plugin (versions ≤ 4.8.7) has an unauthenticated IDOR vulnerability allowing unauthorized access to arbitrary object references. CVSS 5.3 (MEDIUM) reflects low integrity impact. Exploitation details are not provided. Upgrade to a patched version beyond 4.8.7...
