CVE WatchOct 7, 2026

CVE-2026-107102

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls

CVSS

—

No CVSS

EPSS

0.3%

p16

KEV

—

Exploit Today

0-100

Published: Oct 7, 2026 · Last modified: Oct 7, 2026 · CWE-345

EPSS · 30d

0.3%EPSS · 30 days0.3%

2026-10-072026-10-23

Technical description

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an authenticated session for an arbitrary user without valid payment verification. Successful exploitation of this vulnerability could allow the attacker to bypass authentication and gain unauthorized access to other user accounts on the targeted system.

Official references

www.cert-in.org.inhttps://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0430

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1052565.3 MED

1.3%

——0The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.2d CVE-2026-1046422.7 LOW

1.1%

——0The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing users with the Contributor role and above to register attacker-chosen prices for existing products, which any visitor can then use to add those products to the cart at that price.2d CVE-2026-1046415.3 MED

1.4%

——0The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an account they control.2d CVE-2026-1033015.3 MED

1.4%

——0The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as paid. The same handler also marks an attacker-chosen order as failed when given an invalid signature.2d CVE-2026-1140507.5 HIG

6.1%

——2vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache hits, allowing engine crashes. Unauthenticated attackers can desynchronize the P0/P1 processor caches to trigger a fatal token-placeholder mismatch, killing the entire serving instance until restarted.1d CVE-2026-874143.1 LOW

1.3%

——0Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).2d