CVE-2026-97871

Deferred Deferred - Pending Action

Code Injection in Zhonglun CloudPos

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: VulDB

Description

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97871

EUVD

EUVD-2026-87142

Affected Vendors & Products

Vendor	Product	Version / Range
zhonglun	cloudpos	to 3.0.1.76 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a code injection flaw in Zhonglun CloudPos up to version 3.0.1.76. It exists in the OpenLocalBrowser function of the JSBridge.cs file. The issue allows attackers to manipulate the 'url' argument to inject malicious code. The attack can be executed remotely without requiring user interaction.

Detection Guidance

This vulnerability involves code injection in Zhonglun CloudPos via the OpenLocalBrowser function. To detect it, inspect network traffic for unusual URL parameters or requests targeting the JSBridge component. Check logs for unexpected browser launches or script executions from the application.

Impact Analysis

This vulnerability could allow remote attackers to execute arbitrary code on your system by tricking users into visiting a malicious URL. It may lead to unauthorized data access, system compromise, or further network infiltration. The exploit is publicly available, increasing the risk of attacks.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using this software may face compliance violations, legal penalties, and reputational damage due to unauthorized data exposure or system access.

Mitigation Strategies

Immediately update Zhonglun CloudPos to the latest version if available. If no update is available, isolate affected systems from the network to prevent remote exploitation. Monitor network traffic for unusual activity related to the JSBridge component or the OpenLocalBrowser function.

Hi! I’m here to help you understand CVE-2026-97871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70