https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 03:41:44 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-20990 cnvd-2018-20990 https://cve.radiocsirt.org/vuln/cnvd-2018-20990 https://cve.radiocsirt.org/vuln/euvd-2026-177513 EUVD-2026-177513 https://cve.radiocsirt.org/vuln/euvd-2026-177513 https://cve.radiocsirt.org/vuln/fkie_cve-2014-10067 <p>paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.</p> <p>paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly check for test_ipn in production.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2014-10067 https://cve.radiocsirt.org/vuln/ghsa-h698-r4hm-w94p <p><strong>Affected:</strong> npm: paypal-ipn</p> <p>Versions 2.x.x and earlier of `paypal-ipn` are affected by a validation bypass vulnerability.</p> <p>paypal-ipn uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.</p> <p>A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment.</p> <p>## Recommendation</p> <p>Upgrade to version 3.0.0 or later.</p> <p><strong>Affected:</strong> npm: paypal-ipn</p> <p>Versions 2.x.x and earlier of `paypal-ipn` are affected by a validation bypass vulnerability.</p> <p>paypal-ipn uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.</p> <p>A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment.</p> <p>## Recommendation</p> <p>Upgrade to version 3.0.0 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-h698-r4hm-w94p https://cve.radiocsirt.org/vuln/gsd-2014-10067 gsd-2014-10067 https://cve.radiocsirt.org/vuln/gsd-2014-10067