Alipay Vulnerabilities

[en] A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.

Affected:

up to 3.7.2

Fix:

No patched version reported

Disclosed:

Sep 6, 2021

CVE-2021-24390 on NVD →

A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection.

CVSS:

7.2

Affected:

up to 3.7.2

Fix:

No patched version reported

Disclosed:

Jul 23, 2021

CVE-2021-24390 on NVD →

[en] Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.

Affected:

up to 3.7.0

Fixed in:

3.7.0

Disclosed:

Oct 21, 2014

CVE-2014-4514 on NVD →

Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.

CVSS:

6.1

Affected:

up to 3.7.0

Fixed in:

3.7.0

Disclosed:

May 28, 2014

CVE-2014-4514 on NVD →