Skip to content
OpenAdvisories

Vendor

yansongda

1 known vulnerabilities.

Products

pay 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2026-33661

    WeChat Pay callback signature verification bypassed when Host header is localhost

    Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `loca…

    yansongda pay yansongda/pay Packagist