REST API TO MiniProgram

REST API TO MiniProgram has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 2 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2024 was the busiest year with 2 disclosures.

The most common weakness is Authorization Bypass Through User-Controlled Key, behind 1 of the records (20%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Input Validation.

2 of the records (40%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2023.

4 independent researchers contributed these findings, most of them (2) reported by wesley (wcraft).

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage40%

Open

Fixed

Get automatic notifications for all REST API TO MiniProgram vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2023-0551

REST API TO MiniProgram <= 4.7.7 - Authenticated (Subscriber+) Media Attachment Deletion

Read the full analysis

Vulnerability Records

5 records


2026-03-20 15:10	REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter REST API TO MiniProgram <= 5.1.2	`CVE-2026-3460`	5.3 Medium	Ronnachai Sretawat Na Ayutaya (Simonhaskelly)	No
2025-03-11 00:00	REST API TO MiniProgram <= 4.7.1 - Cross-Site Request Forgery REST API TO MiniProgram <= 4.7.1	`CVE-2025-28886`	4.3 Medium	Skalucy	No
2024-09-24 12:22	REST API TO MiniProgram <= 4.7.1 - Unauthenticated Arbitrary User Email Update and Privilege Escalation via Account Takeover REST API TO MiniProgram <= 4.7.1	`CVE-2024-8485`	9.8 Critical	wesley (wcraft)	Yes
2024-09-24 12:22	REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection REST API TO MiniProgram <= 4.7.1	`CVE-2024-8484`	7.5 High	wesley (wcraft)	Yes
2023-04-25 00:00	REST API TO MiniProgram <= 4.7.7 - Authenticated (Subscriber+) Media Attachment Deletion REST API TO MiniProgram <= 4.7.7	`CVE-2023-0551`	6.4 Medium	István Márton	No

Showing 1–5 of 5 reports