Skip to content
OpenAdvisories

Vendor

Petpooja

6 known vulnerabilities.

Products

Munshi 5 Attendo (formerly Petpooja Payroll) 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-119736

    Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials

    Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration…

    Petpooja Attendo (formerly Petpooja Payroll)
  • High 8.1
    CVE-2026-119733

    Munshi Missing Authorization in Company Deletion API

    Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company own…

    Petpooja Munshi
  • High 7.5
    CVE-2026-119731

    Munshi Payment Bypass via Unauthenticated Webhook Endpoint

    Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independen…

    Petpooja Munshi