CVE-2011-5236: Moneris eSelectPlus 2.03 PHP API does not verify that the server hostname matches a domain name in the subj...

Security readout for executives and security teams

This CVE describes a flaw in the Moneris eSelectPlus 2.03 PHP API where HTTPS certificate checks did not confirm the server name. An attacker positioned between the application and payment service could impersonate an SSL server using any valid certificate. Exposure is likely limited to applications still using Moneris eSelectPlus 2.03 PHP API or code derived from it for payment gateway communication. Prioritize if legacy Moneris PHP payment integrations remain in production, especially where payment traffic crosses untrusted networks. No active exploitation is evidenced here. Mitigation focus: Identify any use of Moneris eSelectPlus 2.03 PHP API.; Check Moneris or vendor guidance for supported replacement versions or patches.; Ensure payment API TLS clients enforce hostname verification..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.