CVE-2026-124624

MediumCVSS 5.3/10Last modified Nov 9, 2026

Description

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-259 CWE-798

Affected software

Vendor	Product	Versions
n/a	PipraPay	3.0.0

References

Timeline

Published: Nov 9, 2026
Last modified: Nov 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1246256.3A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-in CVE-2026-1246278.7In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that CVE-2026-1246288.7In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that ide CVE-2026-124634.7Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the re CVE-2026-1246354.7A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the c CVE-2026-1246363.8A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/li CVE-2026-1246375.3A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom and cliCognoms, in a CVE-2026-124648.3Use after free in Browser in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to pot CVE-2026-1246478.6The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a SQL statement in a fr CVE-2026-1246485.3The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a registered user's wish CVE-2026-124658.3Object lifecycle issue in Metrics in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer proces CVE-2026-1246524.3The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before returning its payment st