Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpoint lets admins upload any file to `plugins/payment/`. It only checks a hardcoded password (`qweasd123456`) and ignores file content. A background watcher (`StartWatcher`) then scans this folder every 5 seconds. If it finds a new executable, it runs it immediately, resulting in RCE. Version 4.0.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-18 | 2 | Disclosure1General1 |
| 2026-03-19 | 1 | Disclosure1 |
⚡ New CVE Alert: CVE-2026-28674 📊 Severity: 7.2 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-28674 #CVE-2026-28674 #CVE #High #CyberSecurity #InfoSec https://t.co/hBnTvrAceP
Post summary
A new CVE (CVE‑2026‑28674) with a 7.2 severity score was announced, but no further technical or exploit details were provided.
CVE-2026-28674 Remote Code Execution in xiaoheiFS Financial System via Unauthori... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28674 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post identifies CVE‑2026‑28674 as a remote code execution flaw in xiaoheiFS financial systems, linking to a vulnerability database without further details on exploitation or mitigation.
CVE-2026-28674 xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the `AdminPaymentPluginUpload` endpo… https://www.cve.org/CVERecord?id=CVE-2026-28674
Post summary
The entry identifies CVE-2026-28674 and mentions a specific feature (AdminPaymentPluginUpload) in xiaoheiFS, but it lacks detailed vulnerability, exploitation, patch, or PoC information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | danvei233 | xiaoheifs | - | - | - |