27196 matches found
CVE-2026-105992
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...
CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...
CVE-2026-87837 Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...
EUVD-2026-107086
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...
CVE-2026-87837
The Wava Payment Plugin for WordPress (versions before 0.3.10 ) is vulnerable to an unauthenticated order status change due to a failure to verify the authenticity of incoming payment-provider notifications. An unauthenticated attacker can manipulate any WooCommerce order status, such as marking ...
WordPress Wava Payment Plugin plugin 0.3.1-0.3.9 - Unauthenticated Order Status Change vulnerability
Unauthenticated Order Status Change vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Wava Payment versions 0.3.1-0.3.9...
EUVD-2026-107079
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...
EUVD-2026-107053
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...
PT-2026-120474
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being completed, nor check the payment amount against the order total, allowing unauthenticated users to mark a pending order as paid by replaying a payment...
PT-2026-120482
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as...
PT-2026-120571
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp el editor form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or...
PT-2026-120500
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an...
PT-2026-120448
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying...
Linux Distros Unpatched Vulnerability : CVE-2026-79610
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XSA-501 was about issues with v1 - v2 and v2 - v1 changes racing certain other grant table operations. Sadly a v2 - v1 - v2 change has yet another effect which...
CVE-2020-5839
CVE-2020-5839 CVE-2020-5839 POC Symantec EDR on-prem version prior to "4.4.0" is prone to an information disclosure vulnerability via the following URL's : https://@IPEDR/r3epmpi/status/ https://@IPEDR/r3epmpi/status/routes https://@IPEDR/r3epmpi/v1/event/status/ds...
CVE-2026-85483
A flaw was found in Apache Thrift's C GLib bindings. Due to the use of an uninitialized resource and improper status code handling during request processing, the application can enter an inconsistent state. A remote attacker could exploit this vulnerability to cause a Denial of Service DoS or...
CVE-2026-93229
A flaw was found in the Linux kernel's Network File System daemon nfsd. A local user can cause a Denial of Service DoS or observe inconsistent kernel data on systems with weakly-ordered processor architectures. This issue occurs due to a missing read memory barrier in the Remote Procedure Call RP...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
CVE-2021-44228-Advisories
CVE-2021-44228-Advisories Please open Issues to include an advisory / No PRs. Please check out this list, got more traction than mine : https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592 This list includes all advisories of companies, even if they're just confirming that they're not...