Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Vendor: roncoo Clear all filters
TI-2026-75505 CVE-2026-111719 · GHSA-pxmf-cjhq-vjc3

Missing authorization in Roncoo-pay exposes payment records

Priority HIGH 69

Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.0034 Published 2026-10-16 No fix listed CWE-306
TI-2026-75397 CVE-2026-111611 · GHSA-fcpw-j8r3-2wh6

IDOR in roncoo-education order pay cancel and continue endpoints

Priority LOW 23

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-16 No fix listed CWE-639
TI-2025-10063 CVE-2025-10992 · GHSA-857m-r47g-pcm9

roncoo roncoo-pay lookupList improper authorization

Priority LOW 37

A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00369 Published 2025-09-26 No fix listed CWE-266
TI-2025-09442 CVE-2025-10288 · GHSA-xgjq-frv6-vjfh

roncoo roncoo-pay list improper authentication

Priority HIGH 70

A vulnerability was found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00442 Published 2025-09-12 No fix listed CWE-287
TI-2025-09441 CVE-2025-10287 · GHSA-rm4g-r867-8r8c

roncoo roncoo-pay orderQuery direct request

Priority MEDIUM 45

A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00251 Published 2025-09-12 No fix listed CWE-425