26 matches found
CVE-2026-119733
Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...
CVE-2026-119734
Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...
CVE-2026-119735
Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...
CVE-2026-119731
Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...
CVE-2026-119732
Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...
CVE-2026-119735 Munshi XSS via Purchase Inquiry Thread Rendering
Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...
EUVD-2026-115366
Munshi by Petpooja before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread /purchase-inquiry/thread/thread-id, which is assigned to innerHTML...
CVE-2026-119735
Munshi (by Petpooja) versions prior to 2026-07-13 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The flaw exists in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}) where malicious markup can be injected via item descriptions or messages. The root cause is ...
CVE-2026-119734
The Munshi platform (by Petpooja ) versions released before 2026-06-17 is affected by a broken object level authorization (IDOR) vulnerability. The flaw exists in the GET /purchase-inquiry/thread/{thread-id} endpoint, where authenticated attackers can manipulate the thread identifier to access da...
CVE-2026-119734 Munshi IDOR via Purchase Inquiry Thread Endpoint
Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...
EUVD-2026-115365
Munshi by Petpooja before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/thread-id endpoint. Attackers can modify the...
CVE-2026-119733 Munshi Missing Authorization in Company Deletion API
Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...
CVE-2026-119733
The Munshi platform (by Petpooja) versions prior to 2026-07-07 is vulnerable to a missing authorization flaw in its company deletion workflow at DELETE /api/companies/{company_id}. The application fails to verify company ownership or enforce the company_delete permission. This allows an authentic...
CVE-2026-119733 Munshi Missing Authorization in Company Deletion API
Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...
EUVD-2026-115364
Munshi by Petpooja before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/companyid, where the application fails to enforce the dedicated companydelete permission or verify company ownership. An authenticated invited sub-user wi...
CVE-2026-119732
The Munshi application by Petpooja (versions prior to 2026-07-28) is vulnerable to a broken object level authorization (BOLA) flaw. The vulnerability exists because the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints verify tenant membership but fail to enforce objec...
CVE-2026-119732 Munshi Broken Object Level Authorization via Invoice Deletion API
Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...
EUVD-2026-115363
Munshi by Petpooja before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/invoiceid and POST /api/invoices/bulk-delete endpoints, which only verify...
CVE-2026-119731
The Munshi (by Petpooja) platform (versions prior to 2026-06-30) is vulnerable to a payment bypass via its subscription payment webhook at POST /api/payment/order/webhook. The root cause is a lack of webhook authentication , cryptographic signature verification , source validation , and independe...
CVE-2026-119731 Munshi Payment Bypass via Unauthenticated Webhook Endpoint
Munshi by Petpooja before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the...