{"id":"DRUPAL-CONTRIB-2025-066","details":"This module enables you to pay for Commerce order to an environment provided and secured by the bank\n\nThe module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed.","aliases":["CVE-2025-48445","GHSA-q9h3-r6wr-p3j3"],"modified":"2026-09-10T03:45:17.771235830Z","published":"2025-05-21T17:28:47Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2025-066"}],"affected":[{"package":{"name":"drupal/commerce_eurobank_redirect","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/commerce_eurobank_redirect?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}],"database_specific":{"constraint":"\u003c2.1.1"}}],"database_specific":{"source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/commerce_eurobank_redirect/DRUPAL-CONTRIB-2025-066.json","affected_versions":"\u003c2.1.1"}}],"schema_version":"1.9.0","credits":[{"name":"Marios Tsalkidis (silios)","contact":["https://www.drupal.org/u/silios"]}]}