Skip to content
OpenAdvisories

Vendor

roinli

2 known vulnerabilities.

Products

HUIZHI-ChargeOS-cloud 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-111698

    HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

    HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount …

    roinli HUIZHI-ChargeOS-cloud
  • Medium 6.5
    CVE-2026-111697

    HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

    HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids …

    roinli HUIZHI-ChargeOS-cloud