Skip to content
OpenAdvisories

Vendor

Petpooja

6 known vulnerabilities.

Products

Munshi 5 Attendo (formerly Petpooja Payroll) 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-119735

    Munshi XSS via Purchase Inquiry Thread Rendering

    Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{t…

    Petpooja Munshi
  • Medium 6.5
    CVE-2026-119734

    Munshi IDOR via Purchase Inquiry Thread Endpoint

    Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-…

    Petpooja Munshi
  • Medium 6.5
    CVE-2026-119732

    Munshi Broken Object Level Authorization via Invoice Deletion API

    Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/b…

    Petpooja Munshi