CVE-2026-13461
Description
When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device.
Metadata
Severity & Metrics
No CVSS data available.
Affected products (1)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| PayRange | PayRange | — | 7.0.7 |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| — | cna | CWE-94: Improper Control of Generation of Code ('Code Injection') |