An unknown function in technical‑laohu mpay allows a remote attacker to perform a cross‑site request forgery (CSRF) attack. The vulnerability lets the attacker craft a malicious web request that, when executed in the context of an authenticated user’s browser, can induce the user to trigger unintended actions on the mpay application. The effect is a compromise of integrity and authorization, potentially leading to unauthorized transactions or configuration changes.

technical‑laohu mpay software versions up to and including 1.2.4 are affected. Users running any of these releases should verify their current version and check for updates.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score of <1% implies a low probability of widespread exploitation currently. The exploit is listed in public advisories. The CVE description states that the vulnerability permits remote execution of a CSRF attack. The likely attack vector is a remote attacker sending a crafted request from a malicious site, and it is inferred that the victim must be logged into the mpay application and therefore have an active session cookie in the browser. Because the attack relies on the victim’s browser to send the request, direct server access is not required. The bug is not listed in CISA’s KEV catalog.