Dianping vulnerabilities
We track 1 vulnerability in Dianping products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on September 3, 2026.
1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score
Latest Dianping vulnerabilities
- 9.8 Critical severity
cat: Reliance on Cookies without Validation and Integrity Checking
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin session