Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

1 record

Vendor: goodoneuz Clear all filters
TI-2026-24396 CVE-2026-31843 · GHSA-m5wg-cjgh-223j

goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution

Priority MEDIUM 52

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01383 Published 2026-04-16 Fixed in 3.0.0 CWE-284