Design/Logic Flaw

WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL...

CVE-2018-13439

The CVE-2018-13439 entry affects WXPayUtil in the WeChat Pay Java SDK, where the WXPayUtil class is vulnerable to XML External Entity (XXE) attacks via a merchant notification URL. The connected documents confirm XXE exploitation risk and describe the underlying issue as improper XML processing t...

CVE-2018-13439

WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL...

XXE in WeChat Pay SDK

Background “Mobile payments surge to $9 trillion a year, changing how people shop, borrow—even panhandle”, as WSJ.com once reported. As a payment security researcher, I occasionally found a perilous problem about WeChat Pay which I think may be esay to make use of. Therefore, I hope to be able to...

WeChat Pay SDK XXE Injection Vulnerability

Exploit for java platform in category web applications Title XXE in WeChat Pay Sdk WeChat leave a backdoor on merchant websites ------------------------------------------ Background aMobile payments surge to $9 trillion a year, changing how people shop, borrowaeven panhandlea, as WSJ.com once...

WeChat Pay SDK XXE Injection

Hi List, Title XXE in WeChat Pay Sdk WeChat leave a backdoor on merchant websites ------------------------------------------ Background aMobile payments surge to $9 trillion a year, changing how people shop, borrowaeven panhandlea, as WSJ.com once reported. As a payment security researcher, I...

SQL Injection Vulnerability in Shanghai Siting's WeChat Backend Management System

Ltd. is mainly committed to the automotive industry information technology software solutions, the main object of service are automobile OEMs, dealer groups, 4S stores and a variety of fast repair chain institutions and a series of customers. SQL injection vulnerability exists in the WeChat backe...

CVE-2018-10250

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...

Design/Logic Flaw

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...

CVE-2018-10250

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...

CVE-2018-10250

iCMS v7.0.8 contains a Cross-Site Scripting (XSS) vulnerability in the weixin_category action, exploited via the admincp.php keywords parameter. The issue arises from insufficient sanitization of the keywords input, enabling injection of arbitrary script/HTML when interacting with the WeChat Clas...

CVE-2018-10250

iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...

YzmCMS WeChat Module Reflective Cross-Site Scripting Vulnerability

YzmCMS is a lightweight open source content management system based on PHP+Mysql architecture. A reflective cross-site scripting vulnerability exists in the YzmCMS WeChat module. Attackers can exploit this vulnerability through the admin/module/init.html echostr parameter to conduct cross-site...

Design/Logic Flaw

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The WeChat module in YzmCMS 3.7.1 has reflected XSS via the admin/module/init.html echostr parameter, related to the valid function in application/wechat/controller/index.class.php...

CVE-2018-10026

The CVE describes a reflected cross-site scripting vulnerability in YzmCMS 3.7.1 within the WeChat module. The issue occurs when processing the admin/module/init.html echostr parameter, tied to the valid function in application/wechat/controller/index.class.php. This allows XSS via user-controlle...

Sichuan Jiayuan Electronic Technology Co., Ltd. has an overstepping access vulnerability in the Medjia Cloud

The MediKarma Cloud Platform is a forward-looking medical model solution under the "Internet+Medicine" model. Sichuan Jiayuan Electronic Technology Co., Ltd. medical good cloud WeChat registration platform there is an overstepping access vulnerability, the attacker can use the vulnerability to...

SQL Injection Vulnerability in the delProgram Method of the ChaseGrid WeChat Small Program App Store System

Chasing the grid WeChat small program application store system is a free open source small program store system developed by Chasing the grid technology. The delProgram method of the ChaseGrid WeChat applet store system suffers from a SQL injection vulnerability. Attackers can use the vulnerabili...