CVE-2026-31843 — Vulnerability intelligence

goodoneuz — pay-uz

Published: 2026-04-16T13:02:55.701Z

CVSS

10

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

Sources

• CVE-2026-31843
• Original advisory
• Original advisory
• Original advisory
• Original advisory
• CVE-2026-31843