All 3 CVE vulnerabilities found in ezBookkeeping, with AI-generated Chinese analysis, references, and POCs.
Vendor: mayswind
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-86041 | ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header CWE-348 | 5.3 | Medium | 2026-11-04 |
| CVE-2026-105131 | mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint CWE-863 | 5.4 | Medium | 2026-10-04 |
| CVE-2026-94112 | mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack CWE-294 | 6.8 | Medium | 2026-09-20 |
All 3 known CVE vulnerabilities affecting ezBookkeeping with full Chinese analysis, references, and POCs where available.