Skip to content
OpenAdvisories

Vendor

danvei233

2 known vulnerabilities.

Products

xiaoheiFS 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.2
    CVE-2026-28674

    xiaoheiFS Vulnerable to RCE via Arbitrary Payment Plugin Upload (Automatic Execution)

    xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpoint lets admins upload any file to `plugins/payment/`. It only checks a hardcoded password (`…

    danvei233 xiaoheiFS
  • High 7.2
    CVE-2026-28673

    xiaoheiFS Vulnerable to RCE via Unrestricted Plugin Installation (Manifest Manipulation)

    xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a `manifest.json`. The server trusts the `b…

    danvei233 xiaoheiFS