Vulnerability in Tencent WeChat custom browser could lead to remote code execution

Certain versions of WeChat, a popular messaging app created by tech giant Tencent, contain a type confusion vulnerability that could allow an adversary to execute remote code. While this issue, CVE-2023-3420, was disclosed and patched in the V8 engine in June 2023, the WeChat Webview component wa...

macOS Version of HZ RAT Backdoor Targets Chinese Messaging App Users

Users of Chinese instant messaging apps like DingTalk and WeChat are the target of an Apple macOS version of a backdoor named HZ RAT. The artifacts "almost exactly replicate the functionality of the Windows version of the backdoor and differ only in the payload, which is received in the form of...

HZ Rat backdoor for macOS attacks users of China’s DingTalk and WeChat

In June 2024, we discovered a macOS version of the HZ Rat backdoor targeting users of the enterprise messenger DingTalk and the social network and messaging platform WeChat. The samples we found almost exactly replicate the functionality of the Windows version of the backdoor and differ only in t...

CVE-2024-41658 GHSL-2024-036: Reflected XSS in QrCodePage.js

Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to generate a WechatPay QR code is vulnerable to reflected XSS. When purchasing an item through casdoor, the product page allows you to pay via...

Casdoor 安全漏洞

Casdoor is an open source platform that supports multiple authentication and authorization protocols by Casdoor Open Source. A security vulnerability exists in Casdoor version 1.577.0 and prior versions, which stems from the purchase URL used to generate a QR code for WeChat Payment is susceptibl...

Unspecified Vulnerability in Tencent WeChat (CNVD-2025-06512)

Tencent WeChat 微信 is an online social networking application from the Chinese company Tencent. The program supports sending voice messages, videos, pictures, and text, among other things. An unspecified vulnerability exists in Tencent WeChat. An attacker can exploit the vulnerability to elevate...

CVE-2024-40433

Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component...

CVE-2024-40433

Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component...

CVE-2024-40433

Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component...

Tencent WeChat 安全漏洞

Tencent WeChat 微信 is an online social networking application from the Chinese company Tencent. The program supports sending voice messages, videos, pictures, and text, among other things. An unspecified vulnerability exists in Tencent WeChat. An attacker can exploit the vulnerability to elevate...

CVE-2024-40433

CVE-2024-40433 affects Tencent WeChat 8.0.37. Multiple connected sources describe an Insecure Permissions vulnerability that enables privilege escalation via the web-view component. Root cause and scope are tied to the web-view usage in WeChat, with impact described as elevation of privileges (hi...

CVE-2024-40433

Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to escalate privileges via the web-view component...

PT-2024-28846 · Tencent · Tencent Wechat

Name of the Vulnerable Software and Affected Versions: Tencent WeChat version 8.0.37 Description: The issue allows an attacker to escalate privileges via the web-view component. Recommendations: For version 8.0.37, at the moment, there is no information about a newer version that contains a fix f...

Likeshop 安全漏洞

Likeshop is a complete solution for social commerce strategies from Likeshop Open Source. A security vulnerability exists in Likeshop versions prior to 2.5.7 that stems from the presence of a server-side request forgery SSRF vulnerability that allows an attacker to view sensitive information via...

CVE-2024-27565

A Server-Side Request Forgery SSRF in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests...

CVE-2024-27565

A Server-Side Request Forgery SSRF in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests...

ChatGPT-wechat-personal Security Vulnerability

ChatGPT-wechat-personal is to realize the function of ChatGPT chatbot in WeChat personal subscription number by calling OpenAI latest interface and gpt-3.5-turbo model. A security vulnerability exists in ChatGPT-wechat-personal version a0857f6, which stems from a Server Request Forgery SSRF...

CVE-2024-27565

A Server-Side Request Forgery SSRF in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests...

PT-2024-21949 · Unknown · Chatgpt-Wechat-Personal

Name of the Vulnerable Software and Affected Versions: ChatGPT-wechat-personal affected versions not specified Description: A Server-Side Request Forgery SSRF issue in weixin.php of ChatGPT-wechat-personal allows attackers to force the application to make arbitrary requests. This enables attacker...

CVE-2024-27565

A Server-Side Request Forgery SSRF in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to make arbitrary requests...