PT-2026-64840

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the...

Malicious code in feishu-qrcode-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e20a20734f8fdc2d03dc6bcd76d255f620ab53a1a2e708ebe34e4e16237c491a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qq-qrcode-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dc5a231da669d82038a77d061637b848b5258d7598c0ffe30c1e13612d3b68c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5556 Malicious code in qq-qrcode-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dc5a231da669d82038a77d061637b848b5258d7598c0ffe30c1e13612d3b68c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...