← All credits

Francisco José Ramírez Vicente and Iñigo Sánchez Enciso

28 vulnerability records and advisories credit this contributor.

Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook

Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook

CVE-2026-105975

CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference

Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission

CVE-2026-104028

Anton Extensions <= 1.2.2 - Unauthenticated Arbitrary File Upload to RCE

Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name

Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings

Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling

Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook

Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export