5872 matches found
PT-2026-66743
Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...
PT-2026-66857
Name of the Vulnerable Software and Affected Versions totadministrativemandate versions prior to 1.8.1 Description The payment validation controller in the PrestaShop module lacks a CSRF token, making it susceptible to Cross Site Request Forgery CSRF. This allows an attacker to confirm an order...
CVE-2026-68500
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...
CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...
CVE-2026-68500
The Sylius Mollie Plugin (affected: before versions 2.2.8, 3.2.4, 3.3.1) exposes a vulnerability in the POST /{_locale}/update-payment webhook. The webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment corresponds to the referenced Sylius order,...
CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...
CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...
CVE-2026-15657
A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...
CVE-2026-15657
The CVE-2026-15657 vulnerability affects the foreUP customer REST API, exposing cleartext merchant credentials (Finix) in response bodies. Any authenticated user can read per-record fields such as finix_username, finix_password, and finix_merchant_id, enabling misuse of the payment-processor acco...
EUVD-2026-51163
A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...
CVE-2026-15657 foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials
A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...
CVE-2026-13143 WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at ...
CVE-2026-13178
CVE-2026-13178 affects the Eventin WordPress plugin, prior to version 4.1.16. The vulnerability allows unauthenticated attackers to create orders and set an attacker-controlled order status, resulting in orders being marked as paid without real payment completion. This stems from improper authori...
CVE-2026-13178 Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment...
EUVD-2026-51007
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at ...
CVE-2026-13143
The CVE-2026-13143 entry concerns the WP Travel WordPress plugin before 11.8.1. Vulnerability: it does not verify PayPal Instant Payment Notifications via the PayPal post-back handshake before marking a booking as paid, enabling an unauthenticated actor to forge a notification that flips any pend...
EUVD-2026-50692
Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...
PT-2026-66500
Name of the Vulnerable Software and Affected Versions foreUP affected versions not specified Description A flaw in the customer REST API allows any authenticated user to retrieve cleartext payment-processor merchant credentials within the response body. Recommendations At the moment, there is no...
PT-2026-66606
Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The payment webhook at the POST / locale/update-payment endpoint accepts the id and orderId...