CVE-2025-10992

MediumCVSS 5.3

Published: 26/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 12/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.37%

29th percentile - higher than 29% of all known CVEs

Summary

A vulnerability was determined in roncoo-pay up to commit 9428382af21cd5568319eae7429b7e1d0332ff40. It affects an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed remotely. The exploit has been publicly disclosed and may be utilized. The vendor did not respond.

Risk Assessment

Risk of unauthorized access to user data or system functionality. A remote attack could lead to confidentiality and integrity breaches.

Recommendation

Contact the vendor for patches. If not available, restrict access to /user/info/lookupList and monitor logs for unauthorized requests.

Other vulnerabilities in roncoo-pay

CVE-2026-111719Medium
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.

Original NVD description (English source)

A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS