https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-21T14:19:37.023652+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-113468 fkie_cve-2026-113468 2026-10-21T14:19:37.025416+00:00

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

 https://db.gcve.eu/vuln/ghsa-g779-m64h-785q GHSA-g779-m64h-785q 2026-10-21T14:19:37.025508+00:00

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.