CVE Vulnerability Catalog

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default. This allows unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed.

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation. This allows unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and ships with the secret that would authenticate it empty by default. This allows unauthenticated attackers to mark any pending order as paid and to force any order into a failed status without any secret at all.

The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback. This allows unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured.

The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install. This allows unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.

In NocoDB up to 2026.07.0, the UserRefreshToken.deleteAllUserToken function in /auth/user/signup, part of the PublicApiLimiterGuard component, allows uncontrolled resource allocation. The absence of in-app rate limiting on unauthenticated signup and password-forgot endpoints enables a remote attack of high complexity. The vendor considers the limiter pass-through intentional design and deleted the issue without explanation.

A vulnerability was found in NocoDB up to version 2026.08.0 in an unknown part of the users.service.ts file within the Password-Reset Flow component. The manipulation results in a race condition that can be exploited remotely. The vendor deleted the GitHub issue without explanation and did not respond to disclosure contact.

A vulnerability was found in Z.ai Zcode up to versions 3.14.3/3.15.1 in an unknown functionality of the Sed Command Filter component. The manipulation leads to OS command injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be used.

A security flaw was discovered in GouGuOA up to version 6.1.2 in the chunkUpload function of app/disk/controller/Api.php. Manipulating the file_extension argument results in unrestricted file upload. A public exploit is available and can be used for remote attacks.

A vulnerability was determined in 2K Games Civilization V 1.0.3.144 in the loadstring function of the Lua Sandbox component, leading to type confusion. The attack may be performed remotely, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

A vulnerability has been found in continuedev Continue 2.0.0 in the MCPManagerSingleton.setConnections function of file core/config/ConfigHandler.ts of the MCP Server Transport component, leading to OS command injection. The attack can be executed remotely, and the exploit has been disclosed to the public. The vendor did not respond to the disclosure.

A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0, affecting an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the Local API Server component. This manipulation causes improper access controls, remote exploitation is possible, and the exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in the Datafeedr Product Sets Plugin up to 1.3.24 on WordPress, affecting the function dfrps_ajax_delete_saved_search in the file functions/ajax.php of the AJAX Handlers component. The manipulation results in missing authorization, the attack may be launched remotely, and the exploit is now public and may be used. Upgrading to version 1.3.25 can resolve this issue.

A flaw was found in Sony Neural Network Libraries up to 1.39.0 affecting the func_set_nnabla_version_decorate function in python/src/nnabla/utils/converter/utils.py (NNP Converter component). Manipulating the function.type argument leads to code injection, and the attack can be launched remotely. The exploit has been publicly released and the vendor did not respond to the disclosure.

A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0 affecting the load_param_in_txt function in python/src/nnabla/utils/cli/encode_decode_param.py (Encode Param Command Handler component). Manipulation leads to code injection, and the attack can be launched remotely. The exploit is publicly available and the vendor did not respond to the disclosure.

A vulnerability was found in QuantGeekDev docker-mcp 0.1.0/0.2.0 affecting the _build_windows_command function in docker_executor.py. Manipulating the project_name argument causes OS command injection, and the attack can be initiated remotely.

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0 affecting an unknown function in /deletetransac.php. Manipulating the ID argument results in SQL injection, and the attack can be performed remotely. The exploit has been made public and could be used.

A vulnerability was found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295 affecting the BlitzBanks function of the Skynet++ Virtual Machine component. Manipulation can lead to an out-of-bounds write, and the attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in SteelRaven7 Ravenfield 25407073 affecting the cacheCoverPoints function of the RFL/RFLD Custom Map Handler component. Manipulation results in deserialization, and remote exploitation is possible. A patch named EA39 Security Patch is available.

A security vulnerability was detected in CloudClassroom-PHP-Project affecting an unknown part of addnewstudent.php. Manipulation of the fname argument leads to cross site scripting, and the attack may be launched remotely. The exploit has been publicly disclosed and may be used; the product uses a rolling release model with no version details.