CVE-2026-111698

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or...

CVE-2026-111698

The HUIZHI ChargeOS cloud through 3.0.9 software is affected by a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint. This flaw allows an attacker to modify any member's wallet balance without making a payment by sending requests with arbitrary amount and userId ...

CVE-2026-47696

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess =...