Skip to content
OpenAdvisories

Package · RubyGems

pay

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.4
    CVE-2026-70658

    pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

    Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/controllers/pay/webhooks/paddle_billing_controller.rb compares the computed 64-character SHA-256 HMAC with the attacker-…

    pay-rails pay pay RubyGems
  • High 7.1
    CVE-2023-30614

    Improper Neutralization of Script-Related HTML Tags in a Web Page in pay

    Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails appl…

    pay-rails pay pay RubyGems