Vulnerability · Published Sep 12, 2025 · Assigned by VulDB

CVE-2025-10287roncoo roncoo-pay orderQuery direct request

Low 3.1

In plain English

A low-severity security flaw in roncoo-pay from roncoo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 83.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. The affected element is an unknown function of the file /auth/orderQuery. Such manipulation of the argument orderNo leads to direct request. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
roncoo	roncoo-pay	9428382af21cd5568319eae7429b7e1d0332ff40

Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-323649 | roncoo roncoo-pay orderQuery direct request vdb-entry, technical-description
VDB-323649 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #643387 | roncoo roncoo-pay latest broken function level authorization third-party-advisory
https://www.cnblogs.com/aibot/p/19063496 broken-link, exploit