https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 26 Oct 2026 22:59:59 +0000 https://db.gcve.eu/vuln/cve-2026-115937 <p><strong>Affected:</strong> craftcms commerce-mollie</p> <p>The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:</p> <p>* commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status</p> <p>An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.</p> <p>Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.</p> <p><strong>Affected:</strong> craftcms commerce-mollie</p> <p>The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:</p> <p>* commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects which Mollie payment is queried for its status</p> <p>An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.</p> <p>Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.</p> https://db.gcve.eu/vuln/cve-2026-115937