TI-2025-09442 CVE-2025-10288 · GHSA-xgjq-frv6-vjfh
roncoo roncoo-pay list improper authentication
Priority HIGH 70
A vulnerability was found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.
roncoo
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
roncoo records in CISA KEVNo roncoo vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-75505 CVE-2026-111719 · GHSA-pxmf-cjhq-vjc3
Missing authorization in Roncoo-pay exposes payment records
Priority HIGH 69
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter.
TI-2022-12062 CVE-2022-29632 · GHSA-4mq4-4x8v-h7wv
An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo…
Priority MEDIUM 59
An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file.
TI-2025-09441 CVE-2025-10287 · GHSA-rm4g-r867-8r8c
roncoo roncoo-pay orderQuery direct request
Priority MEDIUM 45
A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.
TI-2025-10063 CVE-2025-10992 · GHSA-857m-r47g-pcm9
roncoo roncoo-pay lookupList improper authorization
Priority LOW 37
A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.
TI-2026-75397 CVE-2026-111611 · GHSA-fcpw-j8r3-2wh6
IDOR in roncoo-education order pay cancel and continue endpoints
Priority LOW 23
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders.