Advisories · Weakness
CWE-472.
Every Advisory and CVE whose sources give the weakness CWE-472, newest first.
- CVSS 7.1 High
Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
- MarcosCamara01 Ecommerce Template
- CWE-472
- CVSS 7.1 High
Mattermost SAML RelayState forgery allows unauthorized team membership
- Mattermost
- CWE-472
- CVSS 8.1 High
Wheels: Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key…
- Wheels
- CWE-472
- CVSS 8.3 High
Lychee: Webshop checkout lets the client override the payment `amount` sent to the gateway via malicious crafted POST request
- Lychee
- Broken access control
- CWE-20
- CVSS 5.3 Medium
InvoiceShelf trusts client-supplied document totals
- InvoiceShelf
- Broken access control
- CWE-472
- CVSS 5.3 Medium
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin".
- EC-CUBE CO.,LTD. AmazonPay V2 Plugin (4.0/4.1 series)
- EC-CUBE CO.,LTD. AmazonPay V2 Plugin (4.2/4.3 series, Bundle Edition)
- CWE-472
- CVSS 5.3 Medium
WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability
- VillaTheme Salevo
- CWE-472
- CVSS 7.1 High
pH7Builder before 18.5.1 Payment Bypass via Payment Module MainController
- ph7software ph7builder
- CWE-472
- CVSS 6.1 Medium
OpenStack Zaqar: In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project…
- OpenStack Zaqar
- CWE-472
- CVSS 5.3 Medium
Magee Shortcodes <= 2.1.1 - Unauthenticated Mail Relay via Contact Form
- Magee Shortcodes
- CWE-472
- CVSS 5.3 Medium
WebToffee Gift Cards for WooCommerce < 1.3.1 - Unauthenticated Gift Card Amount Manipulation via wt_credit_amount
- WebToffee Gift Cards for WooCommerce
- CWE-472
- CVSS 5.3 Medium
Easy PayPal & Stripe Buy Now Button 1.8 - 2.0.5 - Unauthenticated Payment Amount Manipulation via Client-Supplied Price
- Easy PayPal & Stripe Buy Now Button
- CWE-472
- CVSS 5.3 Medium
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
- Bookly
- CWE-472
- CVSS 8.3 High
MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports
- MISP
- Broken access control
- CWE-472
- CVSS 5.3 Medium
RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons
- RestroPress
- CWE-472
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7
- j2commerce.com J2Store extension for Joomla
- CWE-472
- CWE-602
- CVSS 5.3 Medium
WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability
- Saad Iqbal WP EasyPay
- CWE-472
- CVSS 8.7 High
Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6
- j2commerce.com J2Store extension for Joomla
- CWE-472
- CWE-602
- CVSS 5.4 Medium
Jenkins: In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6…
- Jenkins
- CWE-472
- CVSS 5.3 Medium
RegistrationMagic 6.0.0.0 - 6.0.9.8 - Unauthenticated Payment Bypass via Zero Quantity
- RegistrationMagic
- CWE-472
- CVSS 7.7 High
Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2
- balbooa.com Balbooa Forms extension for Joomla
- CWE-472
- CWE-602
- CVSS 6.5 Medium
Wallet System for WooCommerce < 2.7.10 - Customer+ Checkout Price Manipulation via Unvalidated Wallet Amount
- Wallet System for WooCommerce
- CWE-472
- CVSS 7.5 High
WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode
- WPC Name Your Price for WooCommerce
- CWE-472
- CVSS 5.3 Medium
Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price
- Event Booking Manager for WooCommerce (Pro)
- CWE-472
- CVSS 5.3 Medium
WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation
- WP Hotel Booking
- CWE-20
- CWE-472
- CVSS 7.5 High
CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation
- CoCart
- CWE-472
- CVSS 5.3 Medium
Ghost: Paid gift memberships obtainable at minimal cost via the donations feature
- Broken access control
- CWE-472
>=6.27.0, <6.44.0 · fixed in 6.44.0
GHSA-xm43-3m56-w3wf · CVE-2026-59817 - CVSS 5.3 Medium
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
- mohammadr3z المنتور فارسی
- CWE-472
- CVSS 5.3 Medium
Improper Access Control in Abis Technology's AVESİS
- ABIS Technology Ltd. Co. AVESİS
- CWE-472
- CVSS 8.7 High
Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields
- Saturday Drive Ninja Forms
- CWE-472
- CVSS 5.4 Medium
Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.7
- Authentication bypass
- CWE-472
- CVSS 6.3 Medium
The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenticated SCORM session token.
- Skillable SCORM Lab Launch Integration
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…
- Google Chrome
- CWE-472
- CVSS 8.3 High
Google Chrome: Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 9.6 CriticalCritical · CVSS 9+
Google Chrome: Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 5.3 Medium
Google Chrome: Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a…
- Google Chrome
- CWE-472
- CVSS 6.5 Medium
Google Chrome: Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 8.1 High
Google Chrome: Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed…
- Google Chrome
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 8.3 High
Google Chrome: Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 8.3 High
Google Chrome: Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 9.6 CriticalCritical · CVSS 9+
Google Chrome: Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 8.3 High
Google Chrome: Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 7.5 High
WordPress Best Payments Plugin for WP plugin <= 4.6.19 - Payment Bypass vulnerability
- WPManageNinja Best Payments Plugin for WP
- CWE-472
- CVSS 1.2 Low
QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances)
- QNAP Systems Inc. QTS
- QNAP Systems Inc. QuTS hero
- CWE-472
- CVSS 5.3 Medium
Google Chrome: Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 5.3 Medium
Google Chrome: Out of bounds read in Media in Google Chrome on ChromeOS prior to 149.0.7827.103 allowed…
- Google Chrome
- CWE-472
- CVSS 8.3 High
Google Chrome: Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a…
- Google Chrome
- CWE-472
- CVSS 8.3 High
Google Chrome: Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 5.0 Medium
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CWE-472
- CVSS 5.0 Medium
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker…
- Google Chrome
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 9.6 CriticalCritical · CVSS 9+
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CWE-472
- CVSS 8.8 High
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CWE-472
- CVSS 7.5 High
Google Chrome: Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53…
- Google Chrome
- CWE-472
- CVSS 6.5 Medium
Integer overflow in Google Chrome
- Google Chrome
- Memory corruption
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker…
- Google Chrome
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote…
- Google Chrome
- CWE-472
- CVSS 8.8 High
Google Chrome: Integer overflow in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote…
- Google Chrome
- CWE-472