HUIZHI-ChargeOS-cloud vulnerabilities
CVEs whose affected-version data names the HUIZHI-ChargeOS-cloud package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111698Medium· 6.5PoCHUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests …
▾ Twilightroinli · HUIZHI-ChargeOS-cloudvia CVEORG
CVE-2026-111697Medium· 6.5PoCHUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate …
▾ Twilightroinli · HUIZHI-ChargeOS-cloudvia CVEORG