CVE-2026-13461 — PayRange version 7.0.7 contains a JavaScript injection vulnerability
When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls …
Published: 2026-07-09 · CVSS: 9.6 · CVSS 3.1
When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7