CWE-639

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@keycloak/keycloak-admin-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.keycloak:keycloak-js-admin-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-2366"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-12T17:38:28Z",
    "nvd_published_at": "2026-03-12T11:15:55Z",
    "severity": "LOW"
  },
  "details": "A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim\u0027s unique identifier (UUID) and the Organizations feature is enabled.",
  "id": "GHSA-r8jr-wg88-fq5c",
  "modified": "2026-04-02T15:31:35Z",
  "published": "2026-03-12T12:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2366"
    },
    {
      "type": "WEB",
      "url": "https://github.com/keycloak/keycloak/issues/47062"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:6477"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:6478"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-2366"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439081"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/keycloak/keycloak"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Keycloak vulnerable to authorization bypass via the Admin API"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-12131"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T13:15:06Z",
    "severity": "MODERATE"
  },
  "details": "The WP Job Portal \u2013 A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit resumes for other applicants when applying for jobs.",
  "id": "GHSA-r8qg-p9r3-cc3j",
  "modified": "2025-01-07T15:31:47Z",
  "published": "2025-01-07T15:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12131"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/wp-job-portal/tags/2.2.6/modules/jobapply/model.php?rev=3216415"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4772ab0-41cd-4b35-bda9-d72e0fd7b7a5?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-34438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-17T20:15:54Z",
    "severity": "MODERATE"
  },
  "details": "AVideo versions prior to 20.0 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.",
  "id": "GHSA-r8vm-wp6w-fxfh",
  "modified": "2025-12-19T21:30:17Z",
  "published": "2025-12-17T21:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/4a53ab2056"
    },
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/commit/c2feaf25cb"
    },
    {
      "type": "WEB",
      "url": "https://chocapikk.com/posts/2025/avideo-security-vulnerabilities"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/avideo-idor-arbirary-video-rotation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-113596"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-20T16:17:08Z",
    "severity": "LOW"
  },
  "details": "Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users\u0027 project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user\u0027s project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.",
  "id": "GHSA-r95x-94xh-ccwh",
  "modified": "2026-10-20T18:31:44Z",
  "published": "2026-10-20T18:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113596"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webstudio-is/webstudio/issues/5621"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webstudio-is/webstudio/commit/348d049ed2763d2b6c3e00319fa9086ca67c8aa6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/dashboard/src/db/projects.ts"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webstudio-is/webstudio/blob/0.255.0/packages/project/src/trpc/project-router.ts"
    },
    {
      "type": "WEB",
      "url": "https://github.com/webstudio-is/webstudio/releases/tag/0.256.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/webstudio-before-0.256.0-information-disclosure-via-trpc-publishedbuilds-and-findmanybyids"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3124"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-30T02:16:15Z",
    "severity": "HIGH"
  },
  "details": "The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to complete arbitrary pending orders by exploiting a mismatch between the PayPal transaction token and the local order, allowing theft of paid digital goods by paying a minimal amount for a low-cost item and using that payment token to finalize a high-value order.",
  "id": "GHSA-r9gc-9vw9-725f",
  "modified": "2026-03-30T03:30:19Z",
  "published": "2026-03-30T03:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3124"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3470119/download-monitor"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/45527d6c-6866-44e6-85c2-5be984afbbc9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-5309"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-25T05:16:55Z",
    "severity": "MODERATE"
  },
  "details": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to read or modify another group\u0027s virtual registry cleanup policy settings without authorization.",
  "id": "GHSA-r9m9-87p7-xj9f",
  "modified": "2026-06-25T06:30:42Z",
  "published": "2026-06-25T06:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5309"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3628793"
    },
    {
      "type": "WEB",
      "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-1-1-released"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/595468"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-4239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-26T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service, when processing the workreap_addons_service_remove action, allowing any user to delete any post by knowing or guessing the id.",
  "id": "GHSA-r9p3-w49v-jhxq",
  "modified": "2023-01-04T21:30:17Z",
  "published": "2022-12-26T15:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4239"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/1c163987-fb53-43f7-bbff-1c2d8c0d694c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-9812"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T11:17:08Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 11.9.x \u003c= 11.9.0, 11.8.x \u003c= 11.8.4, 11.7.x \u003c= 11.7.7, 10.11.x \u003c= 10.11.22 fail to validate that a property field belongs to the specified run before updating its value which allows an authenticated user with run property-management access to crash the Playbooks plugin via a REST request referencing a property field that belongs to a different run. Mattermost Advisory ID: MMSA-2026-00684",
  "id": "GHSA-r9qc-jm62-qwq5",
  "modified": "2026-09-14T12:31:40Z",
  "published": "2026-09-14T12:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9812"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31867"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-01T15:16:28Z",
    "severity": "MODERATE"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JS Job Manager: from n/a through 2.0.2.",
  "id": "GHSA-rc27-pgc8-phj2",
  "modified": "2026-04-01T18:34:23Z",
  "published": "2025-04-01T15:31:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31867"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/js-jobs/vulnerability/wordpress-js-job-manager-plugin-2-0-2-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/mollie-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/mollie-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/mollie-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "3.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68500"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T16:52:39Z",
    "nvd_published_at": "2026-07-30T21:18:13Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n  The shop payment webhook `POST /{_locale}/update-payment` (route\n  `sylius_mollie_shop_payment_webhook`) accepts two independent, attacker-controlled\n  parameters: `id` (the Mollie payment ID, verified against Mollie\u0027s API) and `orderId` (the\n  Sylius order ID, read directly from the database). The handler never verifies that the\n  Mollie payment belongs to the referenced order.\n\n  An unauthenticated attacker who holds any valid **paid** Mollie payment ID, for example\n  from a EUR 1 order they placed themselves, can submit it together with any victim\n  `orderId`. The victim\u0027s order payment is then transitioned to `completed` (or any other\n  Mollie-derived state) without any funds being transferred for that order. Sylius order IDs\n  are sequential integers, and the endpoint requires no authentication, CSRF token or rate\n  limiting, so the attack scales trivially across all pending orders.\n  \n  ### Patches\n  Fixed in versions **2.2.8**, **3.2.4** and **3.3.1**. The webhook now binds the payment to\n  the order: it reads the Mollie payment ID stored server-side for that order when the payment\n  was created and compares it to the incoming Mollie payment ID. On mismatch the request is\n  acknowledged with `HTTP 200` and no state change is applied. `HTTP 200` is intentional,\n  because Mollie retries the webhook on any non-2xx response.\n\n  The stored ID lives in one of two places depending on the checkout flow, and the fix reads\n  both of them (mirroring `CaptureAction`):\n  \n  - `payment.getDetails()[\u0027payment_mollie_id\u0027]` for the standard Shop API and Apple Pay Direct\n    flows, stored in `CreatePaymentAction`.\n  - `order.getMolliePaymentId()` for the QR-code flow, which stores the ID on the order itself\n    (`QrCodeAction`).\n\n  Reading only the payment details would reject legitimate QR-code payments, because their\n  payment details carry no `payment_mollie_id`, so both sources must be consulted.\n\n  ### Workarounds\n  If you cannot upgrade immediately, patch the vulnerability at the project level by\n  decorating the plugin\u0027s webhook controller. The decorator checks that the incoming Mollie\n  id matches the id stored for that order **before** handing over to the original controller,\n  so no plugin behaviour (state machine, logging) is lost and no extra Mollie API call is\n  made. Works on both 2.2 and 3.x.\n\n  #### Step 1. Create the decorator\n  Create `src/Controller/Mollie/SecurePaymentWebhookController.php` in your Sylius project:\n\n  ```php\n  \u003c?php\n\n  declare(strict_types=1);\n\n  namespace App\\Controller\\Mollie;\n\n  use Sylius\\Component\\Core\\Model\\OrderInterface;\n  use Sylius\\Component\\Order\\Repository\\OrderRepositoryInterface;\n  use Sylius\\MolliePlugin\\Controller\\Shop\\PaymentWebhookController;\n  use Symfony\\Component\\HttpFoundation\\JsonResponse;\n  use Symfony\\Component\\HttpFoundation\\Request;\n  use Symfony\\Component\\HttpFoundation\\Response;\n\n  final class SecurePaymentWebhookController\n  {\n      public function __construct(\n          private readonly PaymentWebhookController $inner,\n          private readonly OrderRepositoryInterface $orderRepository,\n      ) {\n      }\n\n      public function __invoke(Request $request): Response\n      {\n          $orderId = $request-\u003eget(\u0027orderId\u0027);\n          $molliePaymentId = $request-\u003eget(\u0027id\u0027);\n\n          if (null === $orderId || null === $molliePaymentId) {\n              return ($this-\u003einner)($request);\n          }\n\n          /** @var OrderInterface|null $order */\n          $order = $this-\u003eorderRepository-\u003efindOneBy([\u0027id\u0027 =\u003e $orderId]);\n          if (null === $order) {\n              return ($this-\u003einner)($request);\n          }\n\n          $storedMollieId = $this-\u003eresolveStoredMollieId($order);\n  \n          // Reject any webhook whose Mollie id does not match the one stored for this order.\n          // 200 is intentional: Mollie retries on any non-2xx response.\n          if (null === $storedMollieId || $storedMollieId !== (string) $molliePaymentId) {\n              return new JsonResponse(null, Response::HTTP_OK);\n          }\n\n          return ($this-\u003einner)($request);\n      }\n\n      private function resolveStoredMollieId(OrderInterface $order): ?string\n      {\n          $payment = $order-\u003egetLastPayment();\n          $fromDetails = $payment?-\u003egetDetails()[\u0027payment_mollie_id\u0027] ?? null;\n          if (null !== $fromDetails \u0026\u0026 \u0027\u0027 !== $fromDetails) {\n              return (string) $fromDetails;\n          }\n  \n          // QR-code flow stores the Mollie id on the order itself.\n          if (method_exists($order, \u0027getMolliePaymentId\u0027)) {\n              $fromOrder = $order-\u003egetMolliePaymentId();\n              if (null !== $fromOrder \u0026\u0026 \u0027\u0027 !== $fromOrder) {\n                  return (string) $fromOrder;\n              }\n          }\n  \n          return null;\n      }\n  }\n  ```\n\n  #### Step 2. Register the decorator\n  Append to your project\u0027s `config/services.yaml`:\n\n  ```yaml\n  services:\n      App\\Controller\\Mollie\\SecurePaymentWebhookController:\n          decorates: sylius_mollie.controller.shop.payment_webhook\n          public: true\n          arguments:\n              $inner: \u0027@.inner\u0027\n              $orderRepository: \u0027@sylius.repository.order\u0027\n  ```\n\n  \u003e `decorates:` keeps the original service ID, so the route\n  \u003e `_controller: sylius_mollie.controller.shop.payment_webhook` keeps working with no route\n  \u003e changes. `@.inner` is the original plugin controller.\n\n  #### Step 3. Clear the cache\n  ```bash\n  bin/console cache:clear\n  ```",
  "id": "GHSA-rc52-c4hv-w89p",
  "modified": "2026-07-31T16:52:39Z",
  "published": "2026-07-31T16:52:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-rc52-c4hv-w89p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68500"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/pull/351"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/pull/352"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/pull/354"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sylius/MolliePlugin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook"
}