Threats tagged 'ghsa-cq4w-w6h4-82fx'

paicoding version 1.0.3 has a payment bypass vulnerability that enables authenticated attackers to unlock paid articles without proper payment. The flaw arises from weak payment confirmation codes that can be guessed by enumerating approximately 2000 counter values. By submitting a matching verification code to an unauthenticated callback, attackers can mark payments as completed and access paid content.