Vulnerabilities

TI-2026-15501 CVE-2026-18965 · GHSA-fhjr-g4q7-hq4j

Missing Authorization in PayRange API

MEDIUM 40

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-08-27 No fix listed CWE-862

TI-2026-11392 CVE-2026-13462 · GHSA-wpmg-2gv8-722g

PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability

LOW 39

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00303 Published 2026-07-09 No fix listed

TI-2026-11391 CVE-2026-13461 · GHSA-g8qr-vqpc-qjpw

PayRange version 7.0.7 contains a JavaScript injection vulnerability

MEDIUM 43

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00495 Published 2026-07-09 No fix listed

Vulnerabilities

Filters

Missing Authorization in PayRange API

PayRange for Android, version 7.0.7, contains an SSL bypass vulnerability

PayRange version 7.0.7 contains a JavaScript injection vulnerability