CVE-2026-124625 | PipraPay 3.0.0 Admin Panel pp-functions.php deleteData selected_ids/ItemID sql injection (Issue 70)

November 9, 2026 Yanac

A vulnerability, which was classified as critical, has been found in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection.

This vulnerability is traded as CVE-2026-124625. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More