Helena Zajika

The Monobank payment API module, used for integrating Monobank acquiring payments, fails to verify the cryptographic signature of webhooks before processing payment status callbacks. This flaw allows for signature spoofing, where an attacker can forge payment notifications to trick the system into accepting fraudulent payment statuses.

Drupal AlternativeCommerce (Basket) contains an issue where user-supplied data is not sufficiently sanitized before being passed to the PHP `unserialize()` function. This allows for PHP Object Injection, a condition where an attacker can manipulate serialized objects to change the application's logic. If a viable gadget chain—a sequence of existing code fragments that can be executed during deserialization—is present in the site codebase or dependencies, this can lead to arbitrary PHP code execution.