2 matches found
EUVD-2026-102989
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
7.1CVSS5.9AI score0.00326EPSS
SaveExploits0References3
CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
7.1CVSS0.00326EPSS
SaveExploits0References3
20