PT-2026-35034

Name of the Vulnerable Software and Affected Versions New API versions prior to 0.12.10 Description A flaw in the Stripe webhook handler allows unauthenticated attackers to forge webhook events and credit arbitrary quota to their accounts without payment. This is caused by three issues: the syste...

TinyShop SQL注入一枚

简要描述： 20140926 详细说明： 这次这个还是在payment里，是异步callback时候，有类似问题，其实我不想分开交的，其实不想分开交，怕有重复过不了。 /protected/controllers/payment.php中 asynccallback function asynccallback //从URL中获取支付方式 $paymentid = Filter::intReq::get'paymentid'; $payment = new Payment$paymentid; $paymentPlugin = $payment-getPaymentPlugin;...

Road passenger Baba stored in plain text and any password get-vulnerability warning-the black bar safety net

Brief description: Password stored in plain text plus cross-site worms, you know Detailed description: Register road passenger Baba sent a message, the message content for the test code as /textareascriptalertdocumeng. cookie/script I registered two account xxoo2013 and xxoo2014, the password is ...