CRITICALCVSS 9.8Vulnerability
CVE-2026-31843
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.
Properties
- Severity
- CRITICAL
- Summary
- goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files
- Cvss severity
- CRITICAL
- Epss score
- 0.01165
- Cvss score
- 9.8
- Retrieved at
- 2026-10-21T01:24:49+00:00
- Ghsa published
- 2026-04-16T15:31:32Z
- Source url
- https://github.com/advisories/GHSA-m5wg-cjgh-223j
- Ghsa updated
- 2026-04-16T22:58:59Z
- Ghsa id
- GHSA-m5wg-cjgh-223j
- Last source
- FIRST EPSS
- Score
- 9.8
- Cve id
- CVE-2026-31843
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- In Signal since
- initial import (Sep 2026)
- Is ghsa only
- false
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-04-16T13:16:48.473
- Last modified
- 2026-08-10T12:17:14.730
- Epss percentile
- 0.66838
Related Entities (3)
AFFECTS (1)
HAS_WEAKNESS (1)
VULNERABLE_TO (1)
Explore deeper with Ninja Signal's threat intelligence graph