Threats tagged 'ghsa-5q4q-834j-g8g4'

Paymenter before version 1.5.1 contains a vulnerability in its checkout component that allows authenticated users to inject arbitrary URL parameters. These parameters bypass validation and are stored without sanitation, enabling users to override server provisioning settings such as resource limits and package tiers without administrative privileges. This is a business logic flaw affecting the server provisioning process.