zhinianboke CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW zhinianboke CVE published 2026-07-14

CVE-2026-15753

A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw/review?action=approve. Executing a manipulation can lead to trusting http permission methods on the server side. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 19fc3 [truncated]

MEDIUM zhinianboke CVE published 2026-07-14

CVE-2026-15752

A vulnerability was found in the xianyu-auto-reply project, affecting an unknown function of the /api/v1/users/ endpoint. The issue allows for missing authorization, which can be exploited remotely. The project uses a rolling release model, making specific version information for affected or updated releases unavailable. A patch has been applied to fix this issue.