CVE-2026-71537Medium· 6.5▾ SunlitPaymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later execut…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment('amount', abs($price)) without DB::transaction or lockForUpdate() spanning those operations. An authenticated customer with an active downgradable service can submit concurrent downgrade requests that each observe no pending upgrade, create separate upgrade records, and increment the same account credit balance, producing multiple spendable refunds for one downgrade. This issue is fixed in version 1.5.7.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
paymenter/paymenter <= 1.5.6Patched in:
paymenter/paymenter 1.5.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55219Medium· 5.3Paymenter has race condition in payWithCredit() that enables credit double-spend
CVE-2026-47198High· 8.5Paymenter has URL parameter injection that bypasses paid plan limits at checkout
CVE-2025-58048Critical· 9.9Paymenter vulnerable to Remote Code Execution via public file uploads
CVE-2026-44583Medium· 5.3Paymenter has Blind Unauthenticated SSRF on the Paypal gateway module
CVE-2026-44584Medium· 4.3Paymenter doesn't reset email verification status after email change
CVE-2026-44585Medium· 5.4Paymenter has broken object level authorization via service reference manipulation on ticket creation