CVE-2026-31843

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Improper Access Control. Skor CVSS 3.1 9.8 (Critical) menurut CNA.

Deskripsi (NVD)

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

Rincian

Terbit di NVD

16 April 2026

Terakhir diubah

10 Agustus 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/goodoneuz/pay-uz/blob/master/src/Http/Controllers/ApiController.php
• https://github.com/goodoneuz/pay-uz/blob/master/src/routes/web.php
• https://github.com/shaxzodbek-uzb/pay-uz
• https://packagist.org/packages/goodoneuz/pay-uz