CVE-2026-15753

Deferred Deferred - Pending Action

Remote Code Execution in Zhinianboke Xianyu Auto Reply

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: VulDB

Description

A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw/review?action=approve. Executing a manipulation can lead to trusting http permission methods on the server side. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 19fc3282a1bb78a05c34945c088525d20e081cbd. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-15753

EUVD

EUVD-2026-44575

Affected Vendors & Products

Vendor	Product	Version / Range
zhinianboke	xianyu-auto-reply	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-650	The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the zhinianboke xianyu-auto-reply software. It involves a flaw in the /api/v1/payment/withdraw/review?action=approve endpoint where a manipulation could allow unauthorized HTTP permission methods to be trusted on the server side. The issue can be exploited remotely and has been publicly disclosed.

Detection Guidance

The CVE does not provide specific detection methods or commands. It mentions a patch (19fc3282a1bb78a05c34945c088525d20e081cbd) to resolve the issue in the file /api/v1/payment/withdraw/review?action=approve. Check if this endpoint exists and verify if it improperly trusts HTTP methods.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on the server, potentially leading to data breaches or unauthorized transactions. The impact is limited by the low CVSS scores, but it still poses a risk to data integrity and confidentiality.

Mitigation Strategies

Apply the provided patch 19fc3282a1bb78a05c34945c088525d20e081cbd to resolve the issue in zhinianboke xianyu-auto-reply.

Hi! I’m here to help you understand CVE-2026-15753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70