A weakness in the User Center component of technical‑laohu mpay allows an attacker to inject malicious code by manipulating the Nickname field, leading to cross‑site scripting. The injected script runs in the browser of any user who views the affected account, potentially enabling session hijacking, phishing, or defacement of the application. The vulnerability is categorized as CWE‑79 and may also involve command injection aspects identified as CWE‑94. The attack can be launched remotely and a public proof‑of‑concept exploit has already been released on multiple repositories.

The affected product is technical‑laohu mpay version 1.2.4 and earlier. The weakness resides in the User Center module of that product. No other versions or products are listed as impacted.

The CVSS score of 4.8 indicates moderate severity and the EPSS value of less than 1% suggests that the likelihood of exploitation is low at present. However, because a public exploit is available and the vector is remote, the risk to customer data and application integrity should not be underestimated. The vulnerability is not included in the CISA KEV catalog. The attack path involves submitting a specially crafted Nickname value through the user profile interface, which is then reflected unescaped into the user page.