Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-124624— PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials

Quick assessment

Affected

n/a PipraPay

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 PipraPay 3.0.0 中发现一处安全弱点。该漏洞影响组件 pp-token 中的 anti-CSRF 处理器，具体位于文件 pp-content/pp-include/pp-adapter.php 中的 hash_hmac 函数。攻击者可通过远程执行恶意操作，导致硬编码凭据被泄露。利用该漏洞的攻击代码已向公众公开，可被用于实际攻击。项目方此前已通过问题报告获知此问题，但截至目前尚未作出回应。

CVSS 5.3 · Medium Updated Nov 09, 2026

Possible ATT&CK Techniques 2 AI

T1558.004 · AS-REP Roasting T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials

Source: CVE Program / CVE List V5

Vulnerability Description

A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credentials. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的凭证

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	PipraPay	3.0.0	`cpe:2.3:a:piprapay:piprapay::::::::`

II. Public POCs for CVE-2026-124624

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124624

请登录查看更多情报信息。

Other References for CVE-2026-124624 (1)

CVE-2026-124624 | PipraPay 3.0.0 pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials (Issue 69) vdb-entry technical-description

Other References for CVE-2026-124624 (5)

https://github.com/PipraPay/PipraPay/issues/69 exploit issue-tracking
https://github.com/PipraPay/PipraPay/ product
https://vuldb.com/cve/CVE-2026-124624 third-party-advisory
https://vuldb.com/vuln/433049/cti signature permissions-required
https://vuldb.com/submit/1040555 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124624

Same Patch Batch · n/a · 2026-11-09 · 10 CVEs total

CVE-2026-124576	7.3 HIGH	BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow
CVE-2026-124573	7.3 HIGH	logseq Local HTTP API server.cljs validate-auth-token missing authentication
CVE-2026-124554	7.3 HIGH	JeecgBoot JimuBI getAllChartData sql injection
CVE-2026-124625	6.3 MEDIUM	PipraPay Admin Panel pp-functions.php deleteData sql injection
CVE-2026-124555	6.3 MEDIUM	JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql in
CVE-2026-124591	5.5 MEDIUM	Bahleel CsvExporter.php fputcsv csv injection
CVE-2026-124623	4.7 MEDIUM	PipraPay ZIP Archive system-settings-import unrestricted upload
CVE-2026-113702	4.3 MEDIUM	iomad PDF Certificate lib.php local_iomad_pluginfile authorization
CVE-2026-124582	4.3 MEDIUM	WebTorrent File Path torrent.js getFileModtimes path traversal

IV. Related Vulnerabilities

Same product: PipraPay

Same vendor: n/a

Same weakness: CWE-798