CVE-2026-1151: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation of the argument Nickname causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the...

mpay security vulnerability

MPay is a convenient payment tool developed by Technic Laohu in China. Versions of MPay prior to 1.2.4 contained security vulnerabilities. These vulnerabilities were caused by incorrect operations on unknown functions, which could lead to cross-site request forgery attacks...

PT-2026-3436

Name of the Vulnerable Software and Affected Versions technical-laohu mpay versions up to 1.2.4 Description A cross-site request forgery condition exists in technical-laohu mpay. Exploitation of this issue involves manipulation of an unknown function and may allow for remote attacks. The exploit ...

CVE-2026-1152: Unrestricted Upload of File with Dangerous Type

A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Handler. Such manipulation of the argument codeimg leads to unrestricted upload. The attack may be launched remotely. The exploit has been...

PT-2026-3435

Name of the Vulnerable Software and Affected Versions technical-laohu mpay versions up to 1.2.4 Description A security issue exists in the QR Code Image Handler component of technical-laohu mpay. Manipulation of the codeimg argument can lead to unrestricted upload. This issue can be exploited...