SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-13461

CRITICAL · CVSS 9.6 EPSS 0.43%

Source: NVD + CISA KEV + EPSS · Published 2026-07-09 · Last synced 2026-08-08

CyberRota Analysis

AI-Generated

The vulnerability affects the PayRange version 7.0.7 app, allowing attackers to inject JavaScript into a WebView due to an SSL bypass issue. This exploitation enables the attacker to escape the WebView sandbox, potentially leading to unauthorized actions on the user's device. Organizations using this app should prioritize remediation to mitigate the risk of severe security breaches.

CVE
CVE-2026-13461
Severity
CRITICAL
CVSS
9.6
EPSS
0.43%
Java

Original NVD Description

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device.