Threat database

CVE-2026-96332 is a reflected cross-site scripting (XSS) vulnerability in yalla ya! Simple Payment software. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. It affects versions from initial releases up to 2.5.4. The CVSS score is 7.1, indicating a high severity level with potential impacts on confidentiality, integrity, and availability. No patch or remediation details are provided in the source data.

CVE-2026-81767 is a high-severity vulnerability in yalla ya! Simple Payment software versions up to and including 2.5.2. It involves unauthenticated broken access control, classified under CWE-862, which means the software fails to properly enforce authorization checks. This allows unauthorized users to perform actions that should require permissions. The vulnerability has a CVSS 3.1 base score of 7.5, indicating significant impact on integrity without affecting confidentiality or availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.