Veille CVE

Semaine du 12 octobre au 18 octobre 2026

2 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « roinli HUIZHI-ChargeOS-cloud » ✕
  1. CVE-2026-111698 6.5 Moyenne

    roinli HUIZHI-ChargeOS-cloud

    HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.

  2. CVE-2026-111697 6.5 Moyenne

    roinli HUIZHI-ChargeOS-cloud

    HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.