chatlog

Project Removal Notice Update Date: October 20, 2025 What Happened? Hello, thank you for following chatlog. I received a letter from WeChat's official team, which clearly indicates that the core functionality of the project poses compliance risks. In order to completely avoid legal issues and to...

CVE-2024-9106

CVE-2024-9106 Wechat Social login = 1.3.0 - Authentication Bypass Description: The Wechat Social login plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.3.0. This is due to insufficient verification on the user being supplied during the social login...

your-bot-my-inbox-cve-2026-68929-fastgpt-unauthenticated-wechat-channel-hijack

CVE-2026-68929 — FastGPT WeChat Channel Hijack PoC Unauthenticated, cross-tenant takeover of FastGPT's WeChat iLink share channel, keyed only on the publicshareId. | ---|--- CVE| CVE-2026-68929 CVSS 4.0 9.3 Critical Advisory| GHSA-q4pr-3qpg-9q5v Affected| FastGPT = 4.14.10, = 4.15.0,...

MysqlHoneypot

Introduction MysqlHoneypot is a Mysql honeypot project, which mainly uses load data local infile to obtain the user name of the attacker's host Windows platform, and further obtains the WeChat ID according to the user name, and then obtains the user's mobile phone number, login address and other...

CVE-2026-51416

1. Summary Vulnerability Type : Denial of Service / Unrestricted HTTP Response Reading CWE-400 Flagged Location : backend/internal/handler/authwechatoauth.go:1149 Vulnerability Description : The WeChat OAuth token exchange process uses io.ReadAllresp.Body to read the full upstream HTTP response...

CVE-2026-89047

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-90543

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-89047 Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-89047

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) via URL in versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject a...

MMSkillRisk

Guizang Social Card Skill · Xiaohongshu Carousels / WeChat Cover Pairs 中文 README An agent skill for Claude Code, Codex, and similar coding-agent environments. It generates Xiaohongshu / Rednote carousel images , Live Photo motion cards , and WeChat 21:9 + 1:1 cover pairs from articles, copy,...

CVE-2026-89260

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

EUVD-2026-76133

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

CVE-2026-89260 MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

CVE-2026-89260

MoguBlog through 6.2 is affected by an XML External Entity (XXE) injection in the unauthenticated WeChat callback endpoint at POST /wechat/wechatCheck . The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap() , which relies on an unhardened dom4j SAXReader without DTD ...

CVE-2026-89260 MoguBlog through 6.2 XML External Entity Injection in the Unauthenticated WeChat Callback Endpoint

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

PT-2026-89899

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

CVE-2026-89260: Improper Restriction of XML External Entity Reference

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index method passes the raw request body to SignUtil.xmlToMap, which uses an unhardened dom4j SAXReader without DTD or external-entity...

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Researchers at the security firm Calif have built a worm that takes over a WeChat account via an incoming call and demonstrated it spreading among three test phones. The person being called does not have to answer or touch their phone for it to work, but the caller must already be one of their...

CVE-2026-85138

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...

EUVD-2026-70534

A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...