3006 matches found
CVE-2026-111698
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
CVE-2026-111698
The HUIZHI ChargeOS cloud through 3.0.9 software is affected by a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint. This flaw allows an attacker to modify any member's wallet balance without making a payment by sending requests with arbitrary amount and userId ...
EUVD-2026-102989
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
PT-2026-116097
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
boha
@agntn/puzzles Public crypto puzzles and bounties, as typed records. You ask for a puzzle, you get its address, its key material and what happened on chain. Why? Every puzzle thread has the same three things: the addresses, the prizes, and who solved what. Every scanner and tracker re-types them...
batchOverflow
batchOverflow A fix for the batchOverflow bug found by the PeckShield team. a fix The original contract only did a check to ensure the sender has enough whatever to pay the total amount input value x number of addresses. If an overflow ocurred this amount can be zero, which would allow the test o...
Malicious code in wallet-balance-scanner (RubyGems)
Source: amazon-inspector 1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055 The gem declares a native extension at ext/walletbalancescanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rather than a build script, and runs automatically during gem...
Malicious code in wallet-balance-scanner (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055 The gem declares a native extension at ext/walletbalancescanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rath...
MAL-2026-17799 Malicious code in wallet-balance-scanner (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055 The gem declares a native extension at ext/walletbalancescanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rath...
CVE-2026-93945
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0...
EUVD-2026-96185
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0...
CVE-2026-93945 WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0...
CVE-2026-93945
The Axiomthemes Balance WordPress theme (versions
PT-2026-109589
Name of the Vulnerable Software and Affected Versions Axiomthemes Balance versions prior to 1.12.1 Description The Axiomthemes Balance WordPress theme contains a flaw where it deserializes untrusted user-controlled data using the unserialize function. This allows for PHP object injection, where...
WordPress Wallet System for WooCommerce plugin < 2.8.0 - Subscriber+ Arbitrary Wallet Balance Theft vulnerability
Subscriber+ Arbitrary Wallet Balance Theft vulnerability discovered by Stefan Spasic in WordPress Plugin Wallet System for WooCommerce versions 2.8.0...
CVE-2026-93509
The Wallet System for WooCommerce WordPress plugin (versions 2.0.0 - 2.7.10 ) is vulnerable to a wallet balance manipulation flaw. The root cause is a failure to validate that transfer amounts are positive, combined with the system computing the sender's new balance from a stale snapshot taken be...
EUVD-2026-94830
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...
CVE-2026-93509 Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Wallet Balance Manipulation via Negative Transfer Amount
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...