Stripe
Monthly
Cross-organization billing authorization bypass in @better-auth/stripe allows authenticated members of multiple organizations to perform subscription actions - including plan cancellation, plan changes, restoration, and billing portal access - against organizations whose billing they should not control. The root cause is a parameter source mismatch: middleware validates the organization ID from the request query string, while the route handler resolves it from the request body and falls back to the caller's active session organization, enabling an attacker to pass authorization for one org while the action executes against another. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects a network-accessible, low-complexity attack path with high integrity impact on billing state.
stripe-cli is a command-line tool for the payment processor Stripe. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Smokescreen is an HTTP proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Smokescreen is a simple HTTP proxy that fogs over naughty URLs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stripe CLI is a command-line tool for the Stripe eCommerce platform. Rated high severity (CVSS 7.0). This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
vscode-stripe is an extension for Visual Studio Code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Cross-organization billing authorization bypass in @better-auth/stripe allows authenticated members of multiple organizations to perform subscription actions - including plan cancellation, plan changes, restoration, and billing portal access - against organizations whose billing they should not control. The root cause is a parameter source mismatch: middleware validates the organization ID from the request query string, while the route handler resolves it from the request body and falls back to the caller's active session organization, enabling an attacker to pass authorization for one org while the action executes against another. No public exploit has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.1 reflects a network-accessible, low-complexity attack path with high integrity impact on billing state.
stripe-cli is a command-line tool for the payment processor Stripe. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Smokescreen is an HTTP proxy. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.
Smokescreen is a simple HTTP proxy that fogs over naughty URLs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stripe CLI is a command-line tool for the Stripe eCommerce platform. Rated high severity (CVSS 7.0). This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
vscode-stripe is an extension for Visual Studio Code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.