Threats affecting pkg:github/piprapay/PipraPay

CVE-2026-124625 is a SQL injection vulnerability in PipraPay version 3.0.0 affecting the deleteData function in the Admin Panel component. The vulnerability arises from improper handling of the selected_ids/ItemID argument, allowing remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed and exploit code may be available. No official response or patch has been issued by the vendor yet.

CVE-2026-124624 is a vulnerability in PipraPay version 3.0.0 involving hard-coded credentials in the hash_hmac function within the pp-token anti-CSRF handler component. This weakness allows remote attackers to exploit the hard-coded credentials. The vulnerability has a medium severity rating with a CVSS score of 6.9. Public exploit code is available, but no official response or patch has been provided by the vendor as of the publication date.

CVE-2026-124623 is a medium severity vulnerability in PipraPay version 3.0.0. It affects the system-settings-import function in the ZIP Archive Handler component, allowing an attacker to perform unrestricted file uploads remotely. The vulnerability has a CVSS 4.0 base score of 5.1. Public exploit code is available, but no official patch or vendor response has been reported yet.