Security Advisory

CVE-2026-31843

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-16 13:02:55

Last updated 2026-08-10 11:43:31

Assigner TuranSec

CVSS score 10.0

State PUBLISHED

Description

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

← Browse all CVEs View on cve.org ↗