CVE-2026-31843

The CVE concerns the goodoneuz/pay-uz Laravel package (versions ≤ 2.2.24). A flaw in the /payment/api/editable/update endpoint, exposed via Route::any() without authentication, allows unauthenticated remote attackers to overwrite PHP payment hook files. User-supplied input is written directly to ...