A large and reputable online store shows the credit card details of the customer in full on the order confirmation and receipt page (after payment has been processed).
This is the first time I have seen this occur on any online store, as usually it is just the first 6 and last 4 digits from the credit card that are shown as part of the order confirmation.
Surely, this is not PCI compliant and puts customers at risk? But what general methods could an attacker use to exploit this and thus compromise/steal the customers credit card details?
It seems like a pretty significant flaw in their website and payment system...