chatlog

Project Removal Notice Update Date: October 20, 2025 What Happened? Hello, thank you for following chatlog. I received a letter from WeChat's official team, which clearly indicates that the core functionality of the project poses compliance risks. In order to completely avoid legal issues and to...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Authentication Bypass Description: The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login...

CVE-2026-51416

1. Summary Vulnerability Type : Denial of Service / Unrestricted HTTP Response Reading CWE-400 Flagged Location : backend/internal/handler/authwechatoauth.go:1149 Vulnerability Description : The WeChat OAuth token exchange process uses io.ReadAllresp.Body to read the full upstream HTTP response...

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones. The person being called does not have to answer or touch their phone for it to work, but the caller must already be one of their...

your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack

CVE-2026-68929 — FastGPT WeChat Channel Hijack PoC Unauthenticated, cross-tenant takeover of FastGPT's WeChat iLink share channel, keyed only on the publicshareId...

MysqlHoneypot

Introduction MysqlHoneypot is a Mysql honeypot project, which mainly uses load data local infile to obtain the user name of the attacker's host Windows platform, and further obtains the WeChat ID according to the user name, and then obtains the user's mobile phone number, login address and other...

CVE-2026-85138

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

EUVD-2026-70534

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2026-85138

SeaCMS versions up to 13.6 contain a SQL injection vulnerability in the WeChat Module (file weixin/index.php). The root cause lies in the addslashes function, where improper handling of the Content argument allows remote, unauthenticated attackers to inject SQL. The attack vector is network-based...

CVE-2026-68929

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

CVE-2026-68929

FastGPT , an open-source LLM platform, is vulnerable to unauthenticated WeChat channel hijack and denial of service in versions prior to 4.15.2 . The WeChat (iLink) share-channel endpoints authorize requests using only the publicly exposed shareId , with no authenticated identity or team-ownershi...

CVE-2026-68929 FastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat iLink share-channel endpoints authorize requests using only the public shareId, with no authenticated identity or team-ownership check. As a result, an unauthenticated...

PT-2026-82775

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.2 Description WeChat iLink share-channel endpoints authorize requests using only the public shareId without verifying authenticated identity or team ownership. Because the shareId is exposed in shared chat URLs,...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467

CVE-2026-32467 affects the WordPress "[Aotuman] Grab WeChat Articles" plugin up to version 2.0.1. Authenticated subscribers can trigger an SSRF by causing the server to fetch arbitrary internal/external URLs, enabling internal network probing or external requests. CVSS 6.0 MEDIUM (AV:N/AC:H/PR:L/...

CVE-2026-32467 WordPress [Aotuman] Grab WeChat Articles plugin <= 2.0.1 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...

SUSE CVE-2026-44342

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 0.12.0-alpha.1, the email and WeChat account binding endpoints GET /api/oauth/email/bind and GET /api/oauth/wechat/bind used GET requests for state-changing account operations, allowing a...