CVE-2025-60784

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

XiaozhangBang Voluntary Like System security vulnerabilities

XiaozhangBang Voluntary Like System is a software program from XiaozhangBang, a Chinese company. A security vulnerability exists in XiaozhangBang Voluntary Like System version V8.8, which stems from insufficient server-side validation of the parameters zhekou and zid in the file /topfirst.php,...

PT-2025-45162

Name of the Vulnerable Software and Affected Versions XiaozhangBang Voluntary Like System version 8.8 Description A flaw exists in the XiaozhangBang Voluntary Like System version 8.8 that allows remote attackers to manipulate the zhekou parameter within the /topfirst.php Pay module. By sending a...

CVE-2025-60784: Improper Access Control

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

EUVD-2025-37929

A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized discounts. By sending a crafted HTTP POST request with zhekou set to an abnormally low value, an attacker can purchase...

CVE-2025-60784

The XiaozhangBang Voluntary Like System V8.8 is vulnerable to an improper access control flaw in the /topfirst.php Pay module. Due to insufficient server-side validation of the zhekou and zid parameters, remote attackers can send crafted HTTP POST requests to manipulate purchase costs. By setting...