602 matches found
CVE-2026-51416
1. 摘要 漏洞类型 ：拒绝服务 / 无限制 HTTP 响应读取（CWE-400） 标记位置 ：backend/internal/handler/authwechatoauth.go:1149 漏洞描述 ：微信 OAuth 令牌交换过程使用 io.ReadAllresp.Body 将完整的上游 HTTP 响应体读入内存，在缓冲之前未强制执行任何最大大小限制。 2. 分析 步骤 1：检查 backend/internal/handler/authwechatoauth.go:1124 处标记的接收点 已审查标记函数及其周围 50 多行上下文。接收点是令牌交换辅助函数...
chatlog
项目移除通知 更新日期: 2025年10月20日 发生了什么？ 您好，感谢您关注 chatlog。 我收到了来自微信官方的函件 ，明确项目的核心功能存在合规风险。 为了彻底规避法律问题，并本着对开源社区负责任的态度，我决定 移除本项目的全部代码与提交历史记录。 此代码仓库现在仅保留这份说明文件。 这对您意味着什么？ 项目不再可用： 您无法再从此仓库下载代码及预编译程序。 无任何支持： 我不再提供任何形式的支持、更新或安全修复。 自行承担风险： 如果您在本地保留了该项目的旧版本副本，恳请您及时删除相关内容，并提醒您必须自行承担所有潜在风险。我强烈建议您评估继续使用可能带来的合规问题。...
CVE-2026-89047
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-89047 Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
EUVD-2026-90543
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-89047
The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) via URL in versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject a...
MMSkillRisk
MMSkillRisk MMSkillRisk：当多模态技能变成陷阱时，智能体能否保持安全？ 的代码与基准数据。 MMSkillRisk 评估智能体能否在完成合法视觉任务的同时，抵御嵌入在多模态技能中的恶意指令。其原生上下文视觉攻击（Native-Context Visual Attack，NCVA）将指令置于技能教学图像内部，并利用配套的技能说明文字引导智能体关注这些区域。 该基准包含 28 个基础技能、84 个良性任务槽位、36 个受污染技能变体，以及 108 个评估实例 ，覆盖五个风险类别。每个受污染变体均与三个任务配对。 benchmark/skills/clean/ 中恰好包含...
CVE-2024-9106
CVE-2024-9106 Wechat Social login = 1.3.0 - 認証バイパス 説明: WordPress用Wechat Social...
your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack
CVE-2026-68929 — FastGPT 微信频道劫持 PoC 未认证、跨租户接管 FastGPT 的微信（iLink）分享频道，仅需公开的 shareId 即可触发。 | ---|--- CVE| CVE-2026-68929（CVSS 4.0 9.3 严重 ） 公告| GHSA-q4pr-3qpg-9q5v 受影响版本| FastGPT = 4.14.10, = 4.15.0, 下的 iLink 登录二维码 。 qrcode/status — 完全没有授权调用 ；当二维码被确认后，它会将扫描者的 bottoken / accountId / baseUrl 写入由 share...
MysqlHoneypot
はじめに MysqlHoneypot は MySQL ハニーポットプロジェクトです。主に load data local infile を使用して攻撃者のホスト（Windows プラットフォーム）のユーザー名を取得し、さらにそのユーザー名から WeChat ID を取得し、WeChat ID に基づいてユーザーの携帯電話番号、ログインアドレスなどの情報を取得します。読み取られる主なファイルは以下のとおりです： A、C: / Windows / pfro Log 経由で攻撃者の名前を取得 B、C:/Users/UserName/Documents/WeChat Files/All...
CVE-2026-89260
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...
EUVD-2026-76133
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...
CVE-2026-89260 MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...
CVE-2026-89260
MoguBlog through 6.2 is affected by an XML External Entity (XXE) injection in the unauthenticated WeChat callback endpoint at POST /wechat/wechatCheck . The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap() , which relies on an unhardened dom4j SAXReader without DTD ...
CVE-2026-89260 MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...
PT-2026-89899
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...
CVE-2026-89260: Improper Restriction of XML External Entity Reference
MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...
WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls
Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones. The person being called does not have to answer or touch their phone for it to work, but the caller must already be one of their...
CVE-2026-85138
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
EUVD-2026-70534
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...