Paypal
22 CVEs across 22 Paypal products. Browse Paypal vulnerabilities, severities, and proof-of-concept exploits.
Paypal products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25026 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2022-48345 | Medium | 6.1 | 2023-02-24 | sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities. |
CVE-2022-21129 | High | 7.4 | 2023-01-31 | Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function… |
CVE-2021-23648 | Medium | 5.4 | 2022-03-16 | The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function. |
CVE-2017-6217 | Medium | 6.1 | 2019-07-10 | paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution |
CVE-2017-6215 | Medium | 5.4 | 2018-08-02 | paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code execution. |
CVE-2017-6213 | Medium | 5.4 | 2018-08-02 | paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution. |
CVE-2013-7202 | High | 8.1 | 2018-04-27 | The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system. |
CVE-2013-7201 | High | 7.4 | 2018-04-27 | WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive i… |
CVE-2017-6099 | Medium | 6.1 | 2017-02-24 | Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject a… |
CVE-2011-5237 | | 2012-11-06 | PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certif… | |
CVE-2012-5806 | | 2012-11-04 | The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f… | |
CVE-2012-5805 | | 2012-11-04 | The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fie… | |
CVE-2012-5802 | | 2012-11-04 | The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X… | |
CVE-2012-5798 | | 2012-11-04 | The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNa… | |
CVE-2012-5796 | | 2012-11-04 | The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of… | |
CVE-2012-5791 | | 2012-11-04 | PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certific… | |
CVE-2012-5790 | | 2012-11-04 | PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNam… | |
CVE-2012-5789 | | 2012-11-04 | PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjec… | |
CVE-2012-5788 | | 2012-11-04 | The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 ce… | |
CVE-2012-5787 | | 2012-11-04 | The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 c… | |
CVE-2012-5784 | | 2012-11-04 | Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in… | |
CVE-2012-2991 | | 2012-09-19 | The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set the payment recipie… | |
CVE-2012-2058 | | 2012-09-17 | The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors. | |
CVE-2006-0202 | | 2006-01-13 | Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipn_succes… | |
CVE-2006-0201 | | 2006-01-13 | Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to enter false payment… |