https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-22T02:55:29.793459+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2018-20990 cnvd-2018-20990 2026-10-22T02:55:29.796826+00:00 cnvd-2018-20990 https://cve.radiocsirt.org/vuln/euvd-2026-177513 EUVD-2026-177513 2026-10-22T02:55:29.796865+00:00 EUVD-2026-177513 https://cve.radiocsirt.org/vuln/fkie_cve-2014-10067 fkie_cve-2014-10067 2026-10-22T02:55:29.796880+00:00

paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.

 https://cve.radiocsirt.org/vuln/ghsa-h698-r4hm-w94p GHSA-h698-r4hm-w94p — Validation Bypass in paypal-ipn 2026-10-22T02:55:29.796910+00:00

Affected: npm: paypal-ipn

Versions 2.x.x and earlier of `paypal-ipn` are affected by a validation bypass vulnerability.

paypal-ipn uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.

A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment.

## Recommendation

Upgrade to version 3.0.0 or later.

 https://cve.radiocsirt.org/vuln/gsd-2014-10067 gsd-2014-10067 2026-10-22T02:55:29.796939+00:00 gsd-2014-10067