CVE-2026-1151

technical-laohu mpay User Center cross site scripting

State: Published
Severity: 4.8 Medium
Published: Jan 19, 2026
Updated: Feb 23, 2026
Reserved: Jan 18, 2026

Description

A weakness has been identified in technical-laohu mpay up to 1.2.4. The affected element is an unknown function of the component User Center. This manipulation of the argument Nickname causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	2.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
3.0	2.4 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
mpaytechnical-laohu	1.2.0Affected 1.2.1Affected 1.2.2Affected 1.2.3Affected 1.2.4Affected

References

VDB-341744 | technical-laohu mpay User Center cross site scriptingvdb-entrytechnical-description
VDB-341744 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #735773 | https://gitee.com/technical-laohu/mpay mpay v1.2.4 Stored Cross-Site Scriptingthird-party-advisory
https://github.com/bdkuzma/vuln/issues/16exploitissue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.