CVE-2026-15502

Name of the Vulnerable Software and Affected Versions AojiaoZero Antaris version 1.0

Description A SQL injection issue exists in the PayPal IPN Payment Handler component within the /ipn.php file. A remote attacker can exploit this by manipulating the item number argument passed to the rewardPurchase() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /ipn.php file or the rewardPurchase() function to minimize the risk of exploitation.