PT-2026-3436 · Technical Laohu · Mpay

Baihekuz · Published 2026-01-19 · Updated 2026-02-06 · CVE-2026-1153

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions technical-laohu mpay versions up to 1.2.4

Description A cross-site request forgery condition exists in technical-laohu mpay. Exploitation of this issue involves manipulation of an unknown function and may allow for remote attacks. The exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2026-1153

Affected Products

Mpay

References · 9

• 🔥 https://github.com/bdkuzma/vuln/issues/18 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1153 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1153 · Vendor Advisory
• https://vuldb.com/?submit.735789 · Note
• https://vuldb.com/?id.341746 · Note
• https://vuldb.com/?ctiid.341746 · Note
• https://twitter.com/VulmonFeeds/status/2013257736268534171 · Twitter Post
• https://twitter.com/CVEnew/status/2013229524989739227 · Twitter Post
• https://t.me/cveNotify/151192 · Telegram Post