CVE-2026-97871 - Vulnerability Details

- Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection

Description

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published: 2026-09-25

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability allows an attacker to inject code by manipulating the argument provided to the OpenLocalBrowser function in the JSBridge component. The injected input can be executed when the function processes the url parameter, enabling arbitrary code execution on the system that hosts the application. The weakness is an instance of code injection, identified by CWE-74 and CWE-94.

Affected Systems

The flaw exists in Zhonglun CloudPos versions up to 3.0.1.76. Any installation of the CloudPos software before or at that version is affected. The product is offered by Zhonglun under the CloudPos name.

Risk and Exploitability

The CVSS score of 6.9 places this flaw in the medium severity range. The exploit is remotely accessible, and the description states that it has already been disclosed publicly. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which indicates that there is no current large‑scale exploitation known, but the remote nature and code injection imply a high potential impact. Attackers could leverage the vulnerability to run arbitrary code on target systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Zhonglun

CloudPos

affected

Version	Status	Constraints
`3.0.1.0`	affected	—
`3.0.1.1`	affected	—
`3.0.1.2`	affected	—
`3.0.1.3`	affected	—
`3.0.1.4`	affected	—
`3.0.1.5`	affected	—
`3.0.1.6`	affected	—
`3.0.1.7`	affected	—
`3.0.1.8`	affected	—
`3.0.1.9`	affected	—
`3.0.1.10`	affected	—
`3.0.1.11`	affected	—
`3.0.1.12`	affected	—
`3.0.1.13`	affected	—
`3.0.1.14`	affected	—
`3.0.1.15`	affected	—
`3.0.1.16`	affected	—
`3.0.1.17`	affected	—
`3.0.1.18`	affected	—
`3.0.1.19`	affected	—
`3.0.1.20`	affected	—
`3.0.1.21`	affected	—
`3.0.1.22`	affected	—
`3.0.1.23`	affected	—
`3.0.1.24`	affected	—
`3.0.1.25`	affected	—
`3.0.1.26`	affected	—
`3.0.1.27`	affected	—
`3.0.1.28`	affected	—
`3.0.1.29`	affected	—
`3.0.1.30`	affected	—
`3.0.1.31`	affected	—
`3.0.1.32`	affected	—
`3.0.1.33`	affected	—
`3.0.1.34`	affected	—
`3.0.1.35`	affected	—
`3.0.1.36`	affected	—
`3.0.1.37`	affected	—
`3.0.1.38`	affected	—
`3.0.1.39`	affected	—
`3.0.1.40`	affected	—
`3.0.1.41`	affected	—
`3.0.1.42`	affected	—
`3.0.1.43`	affected	—
`3.0.1.44`	affected	—
`3.0.1.45`	affected	—
`3.0.1.46`	affected	—
`3.0.1.47`	affected	—
`3.0.1.48`	affected	—
`3.0.1.49`	affected	—
`3.0.1.50`	affected	—
`3.0.1.51`	affected	—
`3.0.1.52`	affected	—
`3.0.1.53`	affected	—
`3.0.1.54`	affected	—
`3.0.1.55`	affected	—
`3.0.1.56`	affected	—
`3.0.1.57`	affected	—
`3.0.1.58`	affected	—
`3.0.1.59`	affected	—
`3.0.1.60`	affected	—
`3.0.1.61`	affected	—
`3.0.1.62`	affected	—
`3.0.1.63`	affected	—
`3.0.1.64`	affected	—
`3.0.1.65`	affected	—
`3.0.1.66`	affected	—
`3.0.1.67`	affected	—
`3.0.1.68`	affected	—
`3.0.1.69`	affected	—
`3.0.1.70`	affected	—
`3.0.1.71`	affected	—
`3.0.1.72`	affected	—
`3.0.1.73`	affected	—
`3.0.1.74`	affected	—
`3.0.1.75`	affected	—
`3.0.1.76`	affected	—

No data.

Vendor Product Confidence Versions

Zhonglun

Cloudpos

95%

Version	Status	Scheme	Platform
`[3.0.1.0,3.0.1.76]`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Zhonglun CloudPos to a release newer than 3.0.1.76 that addresses the OpenLocalBrowser code injection flaw.
If no patch is immediately available, restrict network access to the application or disable exposure of the OpenLocalBrowser function; validate and sanitize all input URLs to prevent injection.
Disable the OpenLocalBrowser feature entirely if it is not required for normal operation.

Generated by OpenCVE AI on September 25, 2026 at 19:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00518.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/user-attachments/files/30580490/CloudPos.CefSharp.RCE.docx
https://github.com/xy-f0/CVE/issues/5
https://vuldb.com/cve/CVE-2026-97871
https://vuldb.com/submit/911849
https://vuldb.com/vuln/409887
https://vuldb.com/vuln/409887/cti

History

Sat, 26 Sep 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 25 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title		Zhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection
First Time appeared		Zhonglun Zhonglun cloudpos
Weaknesses		CWE-74 CWE-94
CPEs		cpe:2.3:a:zhonglun:cloudpos::::::::
Vendors & Products		Zhonglun Zhonglun cloudpos
References		https://github.com/user-attachments/files/30580490/CloudPos.CefSharp.RCE.docx https://github.com/xy-f0/CVE/issues/5 https://vuldb.com/cve/CVE-2026-97871 https://vuldb.com/submit/911849 https://vuldb.com/vuln/409887 https://vuldb.com/vuln/409887/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Zhonglun Cloudpos

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-25T16:00:11.507Z

Updated: 2026-09-25T16:41:56.883Z

Reserved: 2026-09-25T08:37:57.368Z

Link: CVE-2026-97871

Vulnrichment

Updated: 2026-09-25T16:41:52.868Z

NVD

Status : Deferred

Published: 2026-09-25T17:17:21.443

Modified: 2026-09-28T15:16:04.793

Link: CVE-2026-97871

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-26T13:00:14Z

Weaknesses

CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object