---
id: "CVE-2026-124625"
page: "https://infrastack.ai/live/CVE-2026-124625"
kind: "vulnerability"
aliases: ["CVE-2026-124625"]
title: "PipraPay: admin panel SQL injection in deleteData lets attackers read or change data"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "PipraPay", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "php", "piprapay", "self-hosted"]
not_affected_if: ["admin-panel-not-exposed"]
published_at: "2026-11-09T14:17:16+00:00"
first_seen_at: "2026-11-09T14:26:59+00:00"
updated_at: "2026-11-09T14:27:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124625", "first_seen_at": "2026-11-09T14:26:59+00:00"}]
exploit_sources: []
---

# PipraPay: admin panel SQL injection in deleteData lets attackers read or change data

Link for people: https://infrastack.ai/live/CVE-2026-124625 (this .md is for agents)

PipraPay 3.0.0's admin panel passes the selected_ids/ItemID parameter into a SQL query in the deleteData function without proper sanitization. A remote attacker can inject SQL to read or alter the application's database, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PipraPay affected range not listed fixed no fixed version listed

## How to check

- Check whether PipraPay is installed and which version is running: `pp-content/pp-include/pp-functions.php` in the install directory
- Look for `deleteData` in `pp-content/pp-include/pp-functions.php` and check whether selected_ids or ItemID is used directly in a SQL statement

## Timeline

- 2026-11-09T14:26:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124625

## From the sources

A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_