When the PayRange app version 7.0.7 is run, a flaw, specifically a JavaScript injection (CWE‑94) flaw, permits malicious JavaScript code to be injected into a WebView component if an SSL bypass has been performed. The injected script can call specific functions that escape the WebView sandbox, allowing an attacker to execute arbitrary code on the device. The resulting vulnerability is a high‑severity code‑injection flaw that can compromise confidentiality, integrity, and availability of the user’s data.

The only product explicitly known to be vulnerable is PayRange version 7.0.7. The vulnerability exists in the mobile application and is tied to the presence of an SSL bypass. No other vendors or product versions are listed.

The CVSS score of 9.6 signals a critical severity, but the EPSS score of less than 1% reflects that exploitation is currently rare or unobserved. Because the flaw requires an SSL bypass as a prerequisite, an attacker would first need to establish a man‑in‑the‑middle or certificate‑bypass attack, then deliver the malicious JavaScript. When successful, the attacker gains remote code execution privileges and can perform any action achievable from the device’s user context. While the vulnerability is not yet listed in CISA’s KEV catalog, its combination with a separate SSL bypass makes it a serious risk for users of the affected app.