PIPRAPAY · CVE-2026-124625 · Other
NO FIX YET
PipraPay 3.0.0's admin panel passes the selected_ids/ItemID parameter into a SQL query in the deleteData function without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and a public exploit has been disclosed.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
PipraPay 3.0.0 installations with the admin panel reachable over the network are exposed, since the flaw is in the admin-side delete handler that builds SQL from the selected_ids/ItemID parameter. Teams that do not run PipraPay, or that restrict the admin panel to trusted networks, face less exposure but should still confirm the reach of their admin endpoints. The sources do not say whether an authenticated admin session is required.
Not affected if admin-panel-not-exposed
Who cares php, piprapay, self-hosted
pp-content/pp-include/pp-functions.php in the install directorydeleteData in pp-content/pp-include/pp-functions.php and check whether selected_ids or ItemID is used directly in a SQL statementNo fix yet, per the sources.
A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.