Hotgo
Monthly
Account takeover in HotGo through 2.15.1 is possible because the /admin/sms/send handler honours a client-supplied Code field instead of always generating a server-side SMS verification code, letting an attacker pin a code they already know and replay it against /admin/site/mobileLogin. Unauthenticated remote attackers who know a victim's registered mobile number can sign in as that user, including administrators, with high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code; there is no CISA KEV entry, exploitation is gated by the need to know the target's mobile number and by the SMS/mobile login flow being enabled, and the vendor has published an upstream fix - priority is act_now.
Stored cross-site scripting (XSS) in bufanyun HotGo 1.0/2.0 allows authenticated remote attackers to inject malicious scripts via the editNotice endpoint in the MessageList.vue component, affecting the application's message handling functionality. The vulnerability requires user interaction (UI:R) to execute but has publicly available exploit code and a low CVSS score (3.5) due to limited attack complexity and minimal impact scope. The vendor has not responded to early disclosure attempts.
Account takeover in HotGo through 2.15.1 is possible because the /admin/sms/send handler honours a client-supplied Code field instead of always generating a server-side SMS verification code, letting an attacker pin a code they already know and replay it against /admin/site/mobileLogin. Unauthenticated remote attackers who know a victim's registered mobile number can sign in as that user, including administrators, with high confidentiality, integrity and availability impact. A public PoC reference exists but is not verified as working exploit code; there is no CISA KEV entry, exploitation is gated by the need to know the target's mobile number and by the SMS/mobile login flow being enabled, and the vendor has published an upstream fix - priority is act_now.
Stored cross-site scripting (XSS) in bufanyun HotGo 1.0/2.0 allows authenticated remote attackers to inject malicious scripts via the editNotice endpoint in the MessageList.vue component, affecting the application's message handling functionality. The vulnerability requires user interaction (UI:R) to execute but has publicly available exploit code and a low CVSS score (3.5) due to limited attack complexity and minimal impact scope. The vendor has not responded to early disclosure attempts.