Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 22:27:59 +0000 CVE-2026-123486 — WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php https://db.gcve.eu/vuln/cve-2026-123486 <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.</p> <p><strong>Affected:</strong> WWBN AVideo</p> <p>WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.</p> https://db.gcve.eu/vuln/cve-2026-123486