122 matches found
CVE-2026-111698
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
CVE-2026-111697
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...
CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
EUVD-2026-102989
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
CVE-2026-111698
The HUIZHI ChargeOS cloud through 3.0.9 software is affected by a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint. This flaw allows an attacker to modify any member's wallet balance without making a payment by sending requests with arbitrary amount and userId ...
EUVD-2026-102988
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...
CVE-2026-111697: Authorization Bypass Through User-Controlled Key
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...
CVE-2026-111698: Authorization Bypass Through User-Controlled Key
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
PT-2026-116097
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...
PT-2026-116096
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like...
Hui Ge Open Source Charging Station Platform HUIZHI-ChargeOS-cloud: Authorization Issues and Vulnerabilities
The HUIZHI-ChargeOS-cloud 3.0.9 and earlier versions have an authorization issue vulnerability. This vulnerability stems from the fact that the hcp-mp MeController and OrderController trust the userId, openId, and orderNumber parameters provided by clients. There are insecure direct object...
Hui Ge Open Source Charging Station Platform HUIZHI-ChargeOS-cloud: Authorization Issues and Vulnerabilities
The HUIZHI-ChargeOS-cloud 3.0.9 and earlier versions have an authorization issue vulnerability. This vulnerability stems from a lack of authorization verification at the hcp-mp PayController.xcxRecharge endpoint. Attackers can send requests using arbitrary amount and userId parameters, thereby...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: nfc: hci: fixed an out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at the function entry without first checking whether the buffer holds at least one...
Malicious code in consul-hcp (npm)
The package consul-hcp was found to contain malicious code. --- Credit: OpenSSF source...
CVE-2026-59133 Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability
...
HCP Anywhere - Detect
HCP Anywhere was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HCP Anywhere was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HCP Anywhere - Detect', 'description': 'HCP Anywhere was detected.',...
CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...