CVE-2026-103671
CVE-2026-103671
This page contains facts from public vulnerability sources. Check the original advisory before updating.
External control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's account information may be obtained.
CVSS 5.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
amazonpay v2 plugin (4.0/4.1 series)
- Versions
- ≥ v1.1.7, ≤ v1.1.12: Affected (semver)
No fix published
amazonpay v2 plugin (4.0/4.1 series)
- Versions
- ≥ v1.0.0, ≤ v1.1.6: Affected (semver)
No fix published
amazonpay v2 plugin (4.2/4.3 series, bundle edition)
- Versions
- v4.3.1: Affected
No fix published
amazonpay v2 plugin (4.2/4.3 series)
- Versions
- ≥ v4.2.3, ≤ v4.3.1: Affected (semver)
No fix published
amazonpay v2 plugin (4.2/4.3 series)
- Versions
- ≥ v4.2.0, ≤ v4.2.2: Affected (semver)
No fix published
amazonpay plugin (4.0 series)
- Versions
- ≥ 0, ≤ v1.3.0: Affected (semver)
No fix published