CVE-2026-1152

technical-laohu mpay QR Code Image unrestricted upload

CVSS 5.1 MEDIUMEPSS 0.3%CWE-284 CWE-434

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

19 jan 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A security vulnerability has been detected in technical-laohu mpay up to 1.2.4. The impacted element is an unknown function of the component QR Code Image Handler. Such manipulation of the argument codeimg leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Produtos afetados

technical-laohu · mpay

Referências

https://github.com/bdkuzma/vuln/issues/17 https://vuldb.com/?ctiid.341745 https://vuldb.com/?id.341745 https://vuldb.com/?submit.735775