https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-36285.htmlhttps://patchthecve.com/cve/CVE-2020-36285.htmlWed, 17 Jun 2026 03:15:15 +0000HIGH 7.5: Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.https://patchthecve.com/cve/CVE-2020-36284.htmlhttps://patchthecve.com/cve/CVE-2020-36284.htmlWed, 17 Jun 2026 03:15:15 +0000HIGH 7.5: Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.https://patchthecve.com/cve/CVE-2020-23533.htmlhttps://patchthecve.com/cve/CVE-2020-23533.htmlWed, 17 Jun 2026 03:04:46 +0000HIGH 7.5: Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.