VULNERABILITY INTELLIGENCE
CVE-2026-31843
CVSS score9.8 CRITICAL
EPSS probability1.38%
CISA KEVNot currently listed
Published2026-04-16
Last modified2026-10-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.
Weakness classification
- 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c: CWE-284