Petpooja vulnerabilities
We track 3 vulnerabilities in Petpooja products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Petpooja vulnerabilities
- 8.2 High severity
Attendo (formerly Petpooja Payroll): Use of Hard-coded Credentials
Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration
- 8.1 High severity
Munshi: Missing Authorization
Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company owne
- 7.5 High severity
Munshi: Missing Authentication for Critical Functionality
Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent