jeepay vulnerabilities
CVEs whose affected-version data names the jeepay package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111608Medium· 4.2Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holdin…
▾ Sunlitjeequan · jeepayEPSS 0.25%via CVEORG
CVE-2026-111607High· 7.1PoCJeepay through 3.2.9 IDOR via POST /api/mch/payConfigs
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInte…
▾ Midnightjeequan · jeepayEPSS 0.25%via CVEORG