PT-2026-106370 · Tomlister · Payflex Payment Gateway

Ananda Dhakal

·

CVE-2026-103346

·

Published

2026-10-06

·

Updated

2026-10-06

CVSS v3.1

7.1

High

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Tomlister Payflex Payment Gateway versions prior to 2.7.1
Description An improper neutralization of input during web page generation allows for Reflected Cross-site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation or encoding, allowing an attacker to execute malicious scripts in the victim's browser.
Recommendations Update Tomlister Payflex Payment Gateway to version 2.7.1 or later.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-103346

Affected Products

Payflex Payment Gateway