CVE-2010-4211: Ebay PayPal

Low severity, CVSS 2.9. EPSS: 0.4% chance of exploitation in the next 30 days.

The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.

Affected products

• Ebay PayPal: up to and including 3.0

Published 2010-11-09. Last modified 2026-06-16.