Roinli vulnerabilities
Published CVEs affecting Roinli products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-111698
Medium · 6.5
CWE-639 Oct 16, 2026
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp...
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
CVE-2026-111697
Medium · 6.5
CWE-639 Oct 16, 2026
HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.