roinli vulnerabilities

Products

• roinli/huizhi-chargeos-cloud 2

Latest roinli CVEs

Newest publication first

1. CVE-2026-111698 HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge

   Published 2026-10-16

   High·CVSS 7.1 EPSS 0.33%

   HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters...

2. CVE-2026-111697 HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs

   Published 2026-10-16

   High·CVSS 7.1 EPSS 0.39%

   HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints lik...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.