Petpooja has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 6. The median CVSS is 7.0 (high). None have a confirmed exploitation report. Most affected products: Munshi (5), Attendo (formerly Petpooja Payroll) (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- Munshi 5
- Attendo (formerly Petpooja Payroll) 1
Worst active — by depth score
CVE-2026-119736High· 8.2Attendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials57CVE-2026-119733High· 8.1Munshi Missing Authorization in Company Deletion API57CVE-2026-119732Medium· 6.5Munshi Broken Object Level Authorization via Invoice Deletion API48CVE-2026-119731High· 7.5Munshi Payment Bypass via Unauthenticated Webhook Endpoint41CVE-2026-119734Medium· 6.5Munshi IDOR via Purchase Inquiry Thread Endpoint36
Petpooja vulnerabilities
CVEs affecting Petpooja, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-119736High· 8.2PoCAttendo Admin Android 3.0.13 Hard-coded MQTT Broker Credentials
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled…
CVE-2026-119732Medium· 6.5PoCMunshi Broken Object Level Authorization via Invoice Deletion API
Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} an…
CVE-2026-119733High· 8.1PoCMunshi Missing Authorization in Company Deletion API
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission…
CVE-2026-119735Medium· 5.4Munshi XSS via Purchase Inquiry Thread Rendering
Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purc…
CVE-2026-119734Medium· 6.5Munshi IDOR via Purchase Inquiry Thread Endpoint
Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-i…
CVE-2026-119731High· 7.5Munshi Payment Bypass via Unauthenticated Webhook Endpoint
Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source vali…