https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-20T13:41:12.156332+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-111697 CVE-2026-111697 — HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs 2026-10-20T13:41:12.157481+00:00

Affected: roinli HUIZHI-ChargeOS-cloud

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids against endpoints like /me/getMemberBalanceByUserId and /order/orderDetail to read any member's wallet, credit, profile and charging orders.