CVE-2026-108568

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient...

CVE-2026-108568 InstantSoft icms2 Billing paypal.php validatePaypalOrder data authenticity

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient...

CVE-2026-108568

The InstantSoft icms2 software (versions up to 2.18.2 ) contains a vulnerability in the Billing Module specifically within the validatePaypalOrder function located in the file system/controllers/billing/actions/paypal.php. An attacker can remotely manipulate the bid/sig arguments to cause insuffi...

EUVD-2026-96871

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrder of the file system/controllers/billing/actions/paypal.php of the component Billing Module. Executing a manipulation of the argument bid/sig can lead to insufficient...

CVE-2026-84099 IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further wh...

PT-2019-13830

Name of the Vulnerable Software and Affected Versions CP Contact Form with PayPal plugin versions prior to 1.2.99 Description The issue concerns a Cross-Site Scripting XSS flaw in the publishing wizard of the plugin. This is accessible via the "wp-admin/admin.php?page=cp contact form...

Sql injection

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the 1 checkdownload and possibly 2 checkfilename function in upload/admin2/model/products/modeladmindownload.php or remote authenticated users wit...

CVE-2015-9226: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the 1 checkdownload and possibly 2 checkfilename function in upload/admin2/model/products/modeladmindownload.php or remote authenticated users wit...

PT-2017-7554

Name of the Vulnerable Software and Affected Versions AlegroCart version 1.2.8 Description The issue allows remote administrators to execute arbitrary SQL commands via the download parameter in the check download and possibly check filename function in upload/admin2/model/products/model admin...

Unfixed XSS vulnerability at www.liberty-cig.fr

Security researcher Atmon3r, has submitted on 12/12/2011 a cross-site-scripting XSS vulnerability affecting www.liberty-cig.fr, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It is currently...

CVE-2007-2824

SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php...

CVE-2007-2824

CVE-2007-2824 describes a SQL injection in AlstraSoft E-Friends (versions 4.21 and earlier) where the pack parameter in the paypal action of index.php is unsafely handled, allowing remote attackers to execute arbitrary SQL commands. The underlying issue is unsanitized user input fed into a databa...

CVE-2007-2824: Undefined Security Weakness

SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php...