Vulnerabilidades de Roinli
CVEs publicadas que afetam produtos de Roinli: 2 registro(s), com severidade, exploração e correções.
CVE-2026-111698
Média · 6.5
CWE-639 16/10/2026
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp...
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount and userId parameters to credit or reduce balances and consume charging services for free.
CVE-2026-111697
Média · 6.5
CWE-639 16/10/2026
HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.