CVE-2026-13461PayRange version 7.0.7 contains a JavaScript injection vulnerability

When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device.

9.6 CRITICALEPSS 0.49%Not in KEVNVD: Deferred

Last updated: 2026-07-10 21:16 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.6	CRITICAL	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CVE ID: CVE-2026-13461
Status: Deferred
Assigner (CNA): certcc
Published: Jul 9, 2026
Last modified: 2026-07-10 21:16 UTC

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:30 UTC.