Is CVE-2025-4130 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-4130 being exploited in the wild.

How severe is CVE-2025-4130?

High severity, with a CVSS score of 7.5, published 21 July 2025.

Which products and versions are affected?

PAVO Inc. Pay before 13.05.2025.

Is there a fix for CVE-2025-4130?

A patch was published on 2025-05-13: The vulnerability is addressed in versions released on or after this date. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-4130 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-4130?

Check whether you run PAVO Inc. Pay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-4130: PAVO Inc. PAVO Pay hard-coded credentials

CVE-2025-4130 · Severity: high · CVSS 7.5 · Published 2025-07-21

PAVO Pay, a payment processing solution, contains a security flaw where sensitive credentials or cryptographic keys are permanently embedded within its software code. An unauthorized person could extract these secrets to gain access to restricted data or systems. This could lead to the exposure of sensitive financial information or unauthorized access to the payment platform.

Technologies: PAVO Inc. Pay. Vendors: PAVO Inc..

Quick answers

Is CVE-2025-4130 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-4130 being exploited in the wild.
How severe is CVE-2025-4130?: High severity, with a CVSS score of 7.5, published 21 July 2025.
Which products and versions are affected?: PAVO Inc. Pay before 13.05.2025.
Is there a fix for CVE-2025-4130?: A patch was published on 2025-05-13: The vulnerability is addressed in versions released on or after this date. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-4130 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-4130?: Check whether you run PAVO Inc. Pay at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Use of Hard-coded Credentials vulnerability (CWE-798) exists in PAVO Pay versions prior to 13.05.2025. The application contains sensitive constants, such as passwords or cryptographic keys, embedded directly within the executable file. A remote, unauthenticated attacker can exploit this by reading the executable to retrieve these sensitive constants. This can lead to a complete loss of confidentiality for the affected secrets, potentially enabling further unauthorized access to the system or its data. Users are advised to update to the version released on or after May 13, 2025.

Affected products

PAVO Inc. PAVO Pay before 13.05.2025

Timeline

2025-07-21: advisory: Initial publication of the CVE record.
2025-05-13: patched: The vulnerability is addressed in versions released on or after this date.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.