Stripe
Monthly
Jexactyl releases prior to 4.0.5 accept a client-supplied Stripe Checkout Session at POST /api/client/billing/stripe/process based solely on its payment_status being 'paid', without checking amount_total or currency against the referenced order or the panel's configured billing currency. On instances where the optional billing module is enabled and a Stripe secret key is set, an authenticated client can therefore settle an order with an under-valued or mismatched-currency payment and still have the order fulfilled, provisioning, renewing, upgrading, or unsuspending the associated server for less than the required price. The issue is a bounded payment-integrity/business-logic flaw rather than a critical infrastructure risk; it requires authentication plus the non-default billing and Stripe configuration, is fixed in 4.0.5, and no public exploit code or active exploitation has been identified at time of analysis.
Cross-organization billing authorization bypass in @better-auth/stripe allows authenticated members of multiple organizations to perform subscription actions - including plan cancellation, plan changes, restoration, and billing portal access - against organizations whose billing they should not control. The root cause is a parameter source mismatch: middleware validates the organization ID from the request query string, while the route handler resolves it from the request body and falls back to the caller's active session organization, enabling an attacker to pass authorization for one org while the action executes against another. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects a network-accessible, low-complexity attack path with high integrity impact on billing state.
New API (QuantumNous new-api) before 0.12.10 credits AI quota from forged Stripe webhook events: StripeWebhookSecret defaults to an empty string, so the HMAC-SHA256 signature over a crafted checkout.session.completed payload is publicly computable, and the handler never checks payment_status or that the completed order was actually created through Stripe. A registered account holder can therefore open a pending top-up order via any other configured gateway (Epay, Creem, Waffo), read its trade_no from GET /api/user/topup/self, and replay it through a self-signed Stripe webhook to mark the order successful and add quota without paying - with the fraudulent top-up logging as a normal success. There is no CISA KEV listing; a public PoC reference exists but it is not verified as working exploit code, and EPSS is 0.02% (6th percentile), so the vendor's 'this week' priority reflects the insecure default rather than observed exploitation.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
stripe-cli is a command-line tool for the payment processor Stripe. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Smokescreen is an HTTP proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Smokescreen is a simple HTTP proxy that fogs over naughty URLs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stripe CLI is a command-line tool for the Stripe eCommerce platform. Rated high severity (CVSS 7.0). This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
vscode-stripe is an extension for Visual Studio Code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Jexactyl releases prior to 4.0.5 accept a client-supplied Stripe Checkout Session at POST /api/client/billing/stripe/process based solely on its payment_status being 'paid', without checking amount_total or currency against the referenced order or the panel's configured billing currency. On instances where the optional billing module is enabled and a Stripe secret key is set, an authenticated client can therefore settle an order with an under-valued or mismatched-currency payment and still have the order fulfilled, provisioning, renewing, upgrading, or unsuspending the associated server for less than the required price. The issue is a bounded payment-integrity/business-logic flaw rather than a critical infrastructure risk; it requires authentication plus the non-default billing and Stripe configuration, is fixed in 4.0.5, and no public exploit code or active exploitation has been identified at time of analysis.
Cross-organization billing authorization bypass in @better-auth/stripe allows authenticated members of multiple organizations to perform subscription actions - including plan cancellation, plan changes, restoration, and billing portal access - against organizations whose billing they should not control. The root cause is a parameter source mismatch: middleware validates the organization ID from the request query string, while the route handler resolves it from the request body and falls back to the caller's active session organization, enabling an attacker to pass authorization for one org while the action executes against another. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects a network-accessible, low-complexity attack path with high integrity impact on billing state.
New API (QuantumNous new-api) before 0.12.10 credits AI quota from forged Stripe webhook events: StripeWebhookSecret defaults to an empty string, so the HMAC-SHA256 signature over a crafted checkout.session.completed payload is publicly computable, and the handler never checks payment_status or that the completed order was actually created through Stripe. A registered account holder can therefore open a pending top-up order via any other configured gateway (Epay, Creem, Waffo), read its trade_no from GET /api/user/topup/self, and replay it through a self-signed Stripe webhook to mark the order successful and add quota without paying - with the fraudulent top-up logging as a normal success. There is no CISA KEV listing; a public PoC reference exists but it is not verified as working exploit code, and EPSS is 0.02% (6th percentile), so the vendor's 'this week' priority reflects the insecure default rather than observed exploitation.
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Stripe versions: from 2.0.0 to 2.2.3.
stripe-cli is a command-line tool for the payment processor Stripe. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Smokescreen is an HTTP proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Smokescreen is a simple HTTP proxy that fogs over naughty URLs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stripe CLI is a command-line tool for the Stripe eCommerce platform. Rated high severity (CVSS 7.0). This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
vscode-stripe is an extension for Visual Studio Code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.