PT-2025-39472 · Unknown · Roncoo-Pay

Aibot888 · Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-10992

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions roncoo-pay versions prior to 9428382af21cd5568319eae7429b7e1d0332ff40

Description An issue exists in roncoo-pay where manipulation of an unknown function within the /user/info/lookupList file can lead to improper authorization. This issue can be exploited remotely. The exploit has been publicly disclosed. The vendor was contacted regarding this disclosure but did not respond.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Incorrect Privilege Assignment

Weakness Enumeration

CWE-285

CWE-266

Related Identifiers

CVE-2025-10992

Affected Products

Roncoo-Pay

References · 7

• 🔥 https://cnblogs.com/aibot/p/19063472 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10992 · Security Note
• https://vuldb.com/?ctiid.325919 · Note
• https://t.me/cveNotify/136479 · Telegram Post
• https://t.me/CVEtracker/33397 · Telegram Post
• https://vuldb.com/?submit.653738 · Note
• https://vuldb.com/?id.325919 · Note