lago-stripe-invoice-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lago-stripe-invoice-idor lago-stripe-invoice-idor Lago v1.53.0 - GetLago POST /webhooks/stripe/:organizationid verifies Stripe-Signature with that URL org's webhook secret. Then the one-time branch in...

memscan

memscan Searches for strings, regex, credit card numbers of magnetic stripe card tracks in a process's memory space Memory/Process Scanner Written by Matt Lewis, NCC Group 2014 Updated by Tom Watson, NCC Group 2015 Thanks to Jesse Bullock for lots of great ideas Released as open source by NCC Gro...

New API < v0.12.10 - Stripe Webhook Bypass

New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...

WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update

Bookit WordPress plugin 2.5.1 contains a broken access control vulnerability caused by a publicly accessible REST endpoint allowing unauthenticated update of Stripe payment options, letting remote attackers modify payment settings without authentication. id: CVE-2025-12841 info: name: WordPress...

SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via form_id

The SureForms plugin for WordPress is vulnerable to payment amount validation bypass in versions up to, and including, 2.5.2. The createpaymentintent AJAX handler checks if $formid 0 && !empty$blockid before calling validatepaymentamount. By sending formid=0 the default intval of a missing/zero...

CVE-2026-115450

External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...

CVE-2026-115450 Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...

EUVD-2026-108212

External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...

CVE-2026-115450 Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier

External Control of Assumed-Immutable Web Parameter CWE-472 in the cart and checkout flow of MarcosCamara01 Ecommerce Template allows an authenticated user with no special privileges to be charged the price of one product while placing an order for another, because POST /api/user/cart accepts...

CVE-2026-115450

The MarcosCamara01 Ecommerce Template contains a price manipulation vulnerability (CWE-472 ) within its cart and checkout flow. The POST /api/user/cart endpoint independently accepts variantId (used for order records) and stripeId (used for Stripe charges) without verifying their association. An ...

By-Poloss..-..CVE-2026-12432-PoC

CVE-2026-12432: WP Full Stripe Free = 8.4.4 Published : June 26, 2026 Last Updated : June 27, 2026 Researcher : Netwurm - VTDR e.V.i.G. Vulnerability Description The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the...

CVE-2026-110523

The WP User Manager WordPress plugin versions prior to 2.9.26 is vulnerable to unauthenticated privilege escalation . The flaw occurs because the plugin fails to maintain paid-registration restrictions once a payment gateway is disconnected. Consequently, a published paid registration form will s...

CVE-2026-110523 WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-110523 WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-112293

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293 BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293

The BoxyHQ Enterprise SaaS Starter Kit through version 1.6.0 is vulnerable to a missing authorization vulnerability (CWE-862 ). The root cause is that specific payment routes fail to perform the team_payments permission check, allowing non-owner team members to manage billing. Authenticated users...

CVE-2026-112293 BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

EUVD-2026-104280

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112293: Missing Authorization

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...