Skip to content
Noroxi

PayPal records

25 published records for vendor PayPal.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
20%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 22
  5. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

25 records
  • CVE-2022-21129
    40Plan

    Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.expor

    CriticalCVSS 9.8No exploitEPSS 2%

    paypal · nemo-appiumJan 31, 2023

  • CVE-2013-7202
    33Monitor

    The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system.

    HighCVSS 8.1No exploitEPSS 2%

    paypal · paypalApr 27, 2018

  • CVE-2013-7201
    30Monitor

    WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and

    HighCVSS 7.4No exploitEPSS 1%

    paypal · paypalApr 27, 2018

  • CVE-2012-5784
    25Monitor

    Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Servic

    MediumCVSS 5.8No exploitEPSS 5%

    apache · activemqNov 4, 2012

  • CVE-2021-23648
    24Monitor

    Cross-site Scripting (XSS)

    MediumCVSS 6.1No exploitEPSS 1%

    paypal · braintree\/sanitize-urlMar 16, 2022

  • CVE-2017-6099
    24Monitor

    Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote at

    MediumCVSS 6.1No exploitEPSS 1%

    paypal · merchant-sdk-phpFeb 23, 2017

  • CVE-2017-6217
    24Monitor

    paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution

    MediumCVSS 6.1No exploitEPSS 1%

    paypal · adaptive payments sdkJul 10, 2019

  • CVE-2022-48345
    24Monitor

    sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.

    MediumCVSS 6.1No exploitEPSS 0%

    paypal · braintree\/sanitize-urlFeb 24, 2023

  • CVE-2012-5787
    23Monitor

    The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · merchant sdkNov 4, 2012

  • CVE-2012-5790
    23Monitor

    PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (C

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · payments standardNov 4, 2012

  • CVE-2012-5791
    23Monitor

    PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · invoicingNov 4, 2012

  • CVE-2012-5789
    23Monitor

    PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · payments standardNov 4, 2012

  • CVE-2012-5788
    23Monitor

    The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fi

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · ipnNov 4, 2012

  • CVE-2012-5802
    23Monitor

    The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAlt

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · paypalNov 4, 2012

  • CVE-2012-5796
    23Monitor

    The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subj

    MediumCVSS 5.8No exploitEPSS 0%

    oscommerce · oscommerceNov 4, 2012

  • CVE-2012-5798
    23Monitor

    The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (

    MediumCVSS 5.8No exploitEPSS 0%

    oscommerce · oscommerceNov 4, 2012

  • CVE-2012-5805
    23Monitor

    The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · instant payment notificationNov 4, 2012

  • CVE-2012-5806
    23Monitor

    The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN)

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · payments proNov 4, 2012

  • CVE-2011-5237
    23Monitor

    PayPal WPS ToolKit does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field

    MediumCVSS 5.8No exploitEPSS 0%

    paypal · wps toolkitNov 6, 2012

  • CVE-2017-6213
    21Monitor

    paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter, resulting in code execution.

    MediumCVSS 5.4No exploitEPSS 0%

    paypal · php invoice sdkAug 2, 2018

  • CVE-2017-6215
    21Monitor

    paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter, resulting in code e

    MediumCVSS 5.4No exploitEPSS 0%

    paypal · php permissions sdkAug 2, 2018

  • CVE-2006-0201
    20Monitor

    Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50, and possibly earlier versions, allows remote attackers to e

    MediumCVSS 5.0No exploitEPSS 1%

    paypal · php toolkitJan 13, 2006

  • CVE-2012-2058
    20Monitor

    The Ubercart Payflow module for Drupal does not use a secure token, which allows remote attackers to forge payments via unspecified vectors.

    MediumCVSS 5.0No exploitEPSS 1%

    drupal · drupalSep 17, 2012

  • CVE-2012-2991
    20Monitor

    The PayPal (aka MODULE_PAYMENT_PAYPAL_STANDARD) module before 1.1 in osCommerce Online Merchant before 2.3.4 allows remote attackers to set

    MediumCVSS 5.0No exploitEPSS 1%

    oscommerce · online merchantSep 19, 2012

  • CVE-2006-0202
    14Monitor

    Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for

    LowCVSS 3.6No exploitEPSS 0%

    paypal · php toolkitJan 13, 2006