Amazon Payfort-PHP-SDK vulnerabilities

5 CVEs affecting Amazon Payfort-PHP-SDK, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-19190, published 2018-11-14.

More from Amazon.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-19188, published 2018-11-14. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter.
• CVE-2018-19189, published 2018-11-14. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement.
• CVE-2018-19187, published 2018-11-14. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php echo statement.
• CVE-2018-19190, published 2018-11-14. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter.
• CVE-2018-19186, published 2018-11-14. Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days. The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter.