Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: roinli Clear all filters
TI-2026-75484 CVE-2026-111698 · GHSA-g757-7gqj-36w5

Missing authorization in HUIZHI ChargeOS cloud lets attackers alter balances

Priority MEDIUM 64

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00326 Published 2026-10-16 No fix listed CWE-639
TI-2026-75483 CVE-2026-111697 · GHSA-7f2r-7vg5-f3wp

Insecure direct object reference in HUIZHI ChargeOS cloud exposes member data

Priority MEDIUM 64

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00386 Published 2026-10-16 No fix listed CWE-639