Vulnerability · Published Jan 19, 2026 · Assigned by VulDB
CVE-2026-1151technical-laohu mpay User Center cross site scripting
Low 2.4
In plain English
A low-severity cross-site scripting in mpay from technical-laohu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.2%top 86.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation of the argument Nickname causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| technical-laohu | mpay | 1.2.01.2.11.2.21.2.31.2.4 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-341744 | technical-laohu mpay User Center cross site scripting vdb-entry, technical-description
- VDB-341744 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #735773 | https://gitee.com/technical-laohu/mpay mpay v1.2.4 Stored Cross-Site Scripting third-party-advisory
- https://github.com/bdkuzma/vuln/issues/16 exploit, issue-tracking