Monthly
Authenticated SAML users can join any team - including invite-only teams - on affected Mattermost servers because the application fails to verify the integrity of the SAML RelayState POST parameter, allowing the team_id or invite_id fields inside it to be forged. Exploitation requires the target instance to have SAML single sign-on configured and enabled, and the attacker must already hold valid SAML credentials for that instance (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1); no victim interaction is needed. Impact is bounded to unauthorized team membership rather than administrative takeover. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-priority, authentication-gated authorization flaw rather than a mass-exploitation emergency; no EPSS score was provided in the available intelligence.
Broken object-level authorization in the Wheels CFML framework (versions 1.1 through 4.1.2) allows an authenticated low-privileged user to tamper with other users' associated records through nested forms. The nestedProperties() helper resolves nested hasMany, hasOne, and belongsTo records by the primary key posted in the request without verifying that those rows belong to the parent record being saved, so an attacker who can legitimately submit a nested form for their own parent can reassign, edit, or - when allowDelete=true is configured - delete another parent's rows, and can also create new child rows with attacker-chosen identities when the child model uses a composite primary key that is not composed of foreign keys. The issue carries an assessed CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), requires authentication and actual use of nestedProperties() with nested forms, and is fixed in Wheels 4.2.0; no public exploit identified at time of analysis.
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. The flaw requires a valid member account (CVSS 4.0 PR:L) and an instance that actually sells paid tiers through an enabled gateway, notably PayPal; no public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 18.5.1.
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 allows any anonymous attacker to confirm orders without payment or force other customers' orders to FAILED status. The vulnerability stems from three compounding flaws: a signature verification function that treated UNVERIFIED as acceptable, disabled TLS peer verification on the outbound PayPal check, and amount validation that could be entirely bypassed by omitting the mc_gross field - making the IPN endpoint trivially forgeable with a plain unauthenticated HTTP POST. No public exploit has been identified at time of analysis, but the attack is trivially constructable from the description alone given enumerable order IDs and a merchant receiver_email that is typically public.
Payment amount tampering in Balbooa Forms (Joomla extension) versions prior to 2.4.3.2 allows any unauthenticated visitor to purchase priced items for an attacker-controlled amount - including $0.01 - by submitting a crafted value directly to the stripeCharges or payAuthorize payment endpoints. The server forwards this client-supplied total to the payment gateway without recomputing it from configured product prices, and neither endpoint enforces authentication or CSRF checks, making exploitation trivial with a single HTTP request. No public exploit has been identified at time of analysis, but the attack requires zero prerequisites beyond a published payment-enabled form.
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Price manipulation in the CoCart WordPress plugin before 4.9.0 allows unauthenticated remote attackers to purchase WooCommerce products at arbitrarily low prices by supplying a manipulated price value through the plugin's public REST API cart endpoint. The server accepts the attacker-controlled price without comparing it to the canonical product price, enabling completed orders at near-zero cost and direct financial loss to store operators. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is trivially exploitable against any default-configured CoCart deployment.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is an integer overflow in V8, rated High by Chromium and scored CVSS 8.8; exploitation requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity yet.
Authenticated SAML users can join any team - including invite-only teams - on affected Mattermost servers because the application fails to verify the integrity of the SAML RelayState POST parameter, allowing the team_id or invite_id fields inside it to be forged. Exploitation requires the target instance to have SAML single sign-on configured and enabled, and the attacker must already hold valid SAML credentials for that instance (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1); no victim interaction is needed. Impact is bounded to unauthorized team membership rather than administrative takeover. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-priority, authentication-gated authorization flaw rather than a mass-exploitation emergency; no EPSS score was provided in the available intelligence.
Broken object-level authorization in the Wheels CFML framework (versions 1.1 through 4.1.2) allows an authenticated low-privileged user to tamper with other users' associated records through nested forms. The nestedProperties() helper resolves nested hasMany, hasOne, and belongsTo records by the primary key posted in the request without verifying that those rows belong to the parent record being saved, so an attacker who can legitimately submit a nested form for their own parent can reassign, edit, or - when allowDelete=true is configured - delete another parent's rows, and can also create new child rows with attacker-chosen identities when the child model uses a composite primary key that is not composed of foreign keys. The issue carries an assessed CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), requires authentication and actual use of nestedProperties() with nested forms, and is fixed in Wheels 4.2.0; no public exploit identified at time of analysis.
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. The flaw requires a valid member account (CVSS 4.0 PR:L) and an instance that actually sells paid tiers through an enabled gateway, notably PayPal; no public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 18.5.1.
Unauthenticated order-state tampering in the J2Store e-commerce extension for Joomla (versions 1.0.0–3.3.2, 4.0.0–4.0.22, and 4.1.0–4.1.7) lets anyone mark any order as FAILED without supplying a payment amount, transaction ID, or any other verification data. An attacker can mass-fail pending orders to disrupt revenue, or flip already-fulfilled orders back to FAILED, triggering unwarranted refunds, cancellations, and customer-support load. The CVE carries a CVSS 4.0 score of 8.7 driven entirely by high integrity impact; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Unauthenticated PayPal IPN callback forgery in J2Store (Joomla e-commerce extension) versions 1.0.0-3.3.21, 4.0.0-4.0.21, and 4.1.0-4.1.6 allows any anonymous attacker to confirm orders without payment or force other customers' orders to FAILED status. The vulnerability stems from three compounding flaws: a signature verification function that treated UNVERIFIED as acceptable, disabled TLS peer verification on the outbound PayPal check, and amount validation that could be entirely bypassed by omitting the mc_gross field - making the IPN endpoint trivially forgeable with a plain unauthenticated HTTP POST. No public exploit has been identified at time of analysis, but the attack is trivially constructable from the description alone given enumerable order IDs and a merchant receiver_email that is typically public.
Payment amount tampering in Balbooa Forms (Joomla extension) versions prior to 2.4.3.2 allows any unauthenticated visitor to purchase priced items for an attacker-controlled amount - including $0.01 - by submitting a crafted value directly to the stripeCharges or payAuthorize payment endpoints. The server forwards this client-supplied total to the payment gateway without recomputing it from configured product prices, and neither endpoint enforces authentication or CSRF checks, making exploitation trivial with a single HTTP request. No public exploit has been identified at time of analysis, but the attack requires zero prerequisites beyond a published payment-enabled form.
Price allowlist bypass in WPC Name Your Price for WooCommerce (WordPress plugin before 2.2.5) permits unauthenticated visitors to submit arbitrary below-minimum prices for products configured in "Select" mode, resulting in real completed orders at merchant-disadvantageous amounts and direct revenue loss. The flaw is a distinct business logic failure left unaddressed by the CVE-2025-12115 patch (v2.2.0), which only corrected a related but separate vector involving products with Name Your Price disabled. No public exploit identified at time of analysis, though the attack requires no authentication and is trivially executable against any vulnerable storefront with a Select-mode product.
Price manipulation in the CoCart WordPress plugin before 4.9.0 allows unauthenticated remote attackers to purchase WooCommerce products at arbitrarily low prices by supplying a manipulated price value through the plugin's public REST API cart endpoint. The server accepts the attacker-controlled price without comparing it to the canonical product price, enabling completed orders at near-zero cost and direct financial loss to store operators. No public exploit code or CISA KEV listing has been identified, but the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicates this is trivially exploitable against any default-configured CoCart deployment.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.46) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is an integer overflow in V8, rated High by Chromium and scored CVSS 8.8; exploitation requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, indicating no observed in-the-wild activity yet.