Monobank Payment Api
Monthly
Signature spoofing in the Drupal Monobank payment API module (versions 0.0.0 through the 1.0.3 range boundary) allows a remote, unauthenticated actor to submit a payment notification/callback whose cryptographic signature the module fails to verify properly, so a forged payment confirmation can be accepted as genuine. Impact is limited to integrity (CVSS 3.7, C:N/I:L/A:N) with no confidentiality or availability effect, and only sites that have the contrib module installed and active as a payment integration are exposed. Exploitation status is low-risk: no CISA KEV listing, EPSS 0.10% (1st percentile), a public PoC reference exists but is not verified as working exploit code, the vendor has released a fixed release, and the independent assessment rates all decision signals as a low real-world priority (monitor).
Signature spoofing in the Drupal Monobank payment API module (versions 0.0.0 through the 1.0.3 range boundary) allows a remote, unauthenticated actor to submit a payment notification/callback whose cryptographic signature the module fails to verify properly, so a forged payment confirmation can be accepted as genuine. Impact is limited to integrity (CVSS 3.7, C:N/I:L/A:N) with no confidentiality or availability effect, and only sites that have the contrib module installed and active as a payment integration are exposed. Exploitation status is low-risk: no CISA KEV listing, EPSS 0.10% (1st percentile), a public PoC reference exists but is not verified as working exploit code, the vendor has released a fixed release, and the independent assessment rates all decision signals as a low real-world priority (monitor).