392 matches found
CVE-2026-85138: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
optimuspyspark (>=2.0.3, <=2.1.0), takemessagecleaner (>=1.1.0, <=1.1.4) +1 more potentially affected by CVE-2026-59890 via setuptools (40.2.0)
setuptools PYPI version 40.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - optimuspyspark =2.0.3, =1.1.0, =1.1.4 - work-weixin 0.0.2.3 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...
@0xwork/connect (0.1.8), @chrysb/alphaclaw (>=0.8.7, <=0.9.16) +8 more potentially affected by CVE-2026-62218 via openclaw (>=2026.4.5, <=2026.5.24-beta.2)
openclaw NPM version =2026.4.5, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =2.1.8, =0.1.0, =0.1.38, =0.1.39 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-62218 Source advisory: MEND:CVE-2026-62218...
optimuspyspark (>=2.0.3, <=2.1.0), takemessagecleaner (>=1.1.0, <=1.1.4) +1 more potentially affected by CVE-2026-59890 via setuptools (40.2.0)
setuptools PYPI version 40.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - optimuspyspark =2.0.3, =1.1.0, =1.1.4 - work-weixin 0.0.2.3 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...
optimuspyspark (>=2.0.3, <=2.1.0), takemessagecleaner (>=1.1.0, <=1.1.4) +1 more potentially affected by CVE-2024-6345 via setuptools (40.2.0)
setuptools PYPI version 40.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - optimuspyspark =2.0.3, =1.1.0, =1.1.4 - work-weixin 0.0.2.3 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...
@chrysb/alphaclaw (>=0.8.7, <=0.9.16), @ericmmj/openclaw-weixin (>=2.2.4, <=2.2.5) +7 more potentially affected by CVE-2026-53836 via openclaw (>=2026.4.5, <=2026.5.7)
openclaw NPM version =2026.4.5, =0.8.7, =2.2.4, =4.0.0, =2.1.8, =0.1.0, =0.1.38, =0.1.39 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-53836 Source advisory: OSV:GHSA-J472-GF56-X589...
@chrysb/alphaclaw (>=0.8.7, <=0.9.16), @ericmmj/openclaw-weixin (>=2.2.4, <=2.2.5) +7 more potentially affected by CVE-2026-32906 via openclaw (>=2026.4.5, <=2026.5.7)
openclaw NPM version =2026.4.5, =0.8.7, =2.2.4, =4.0.0, =2.1.8, =0.1.0, =0.1.38, =0.1.39 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-32906 Source advisory: OSV:GHSA-WV26-J37Q-2G7P...
@chrysb/alphaclaw (>=0.8.7, <=0.9.16), @ericmmj/openclaw-weixin (>=2.2.4, <=2.2.5) +7 more potentially affected by CVE-2026-53820 via openclaw (>=2026.4.5, <=2026.5.7)
openclaw NPM version =2026.4.5, =0.8.7, =2.2.4, =4.0.0, =2.1.8, =0.1.0, =0.1.38, =0.1.39 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-53820 Source advisory: OSV:GHSA-QH2F-99MV-MRCF...
weixin-python XML External Entity vulnerability
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/toxml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The name...
PYSEC-2026-572 weixin-python XML External Entity vulnerability
A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/toxml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The name...
@0xwork/connect (0.1.8), @chrysb/alphaclaw (>=0.8.7, <=0.9.16) +8 more potentially affected by CVE-2026-53838 via openclaw (>=2026.4.5, <=2026.5.24-beta.2)
openclaw NPM version =2026.4.5, =0.8.7, =2.2.4, =4.0.0, =0.2.5, =2.1.8, =0.1.0, =0.1.38, =0.1.39 - morpho-vault-manager 0.1.0 - openclaw-morpho-vault-manager 0.2.0 Source cves: CVE-2026-53838 Source advisory: SNYK:JS-OPENCLAW-17339814...
com.github.binarywang:weixin-java-common (>=3.7.7.b, <=3.9.0), com.github.fangjinuo.agileway:agileway-redis (>=2.0.0, <=3.1.12) +31 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.2.23.release)
org.springframework.data:spring-data-keyvalue MAVEN version 1.2.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.binarywang:weixin-java-common =3.7.7.b, =2.0.0,...
CVE-2026-8320 jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl lead...
CVE-2026-8320 jishenghua jshERP updatePlatformConfigByKey Endpoint UserService.java getUserByWeixinCode server-side request forgery
A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl lead...
MetInfo CMS CVE-2026-29014 Exploited for Remote Code Execution Attacks
Threat actors are actively exploiting a critical security flaw impacting an open-source content management system CMS known as MetInfo, according to new findings from VulnCheck. The vulnerability in question is CVE-2026-29014 CVSS score: 9.8, a code injection flaw that could result in arbitrary...
đ MetInfo CMS 8.1 PHP Code Injection
This Python script is a full remote code execution exploit suite targeting a vulnerability in MetInfo CMS versions 8.1 and below. The flaw resides in the weixin module handling logic, where improperly sanitized input allows PHP code injection via crafted XML and HTTP parameters/headers...
đ MetInfo CMS 8.1 Code Injection
MetInfo CMS versions 8.1 and below suffer from a PHP code injection vulnerability in weixinreply.class.php. --------------------------------------------------------------------------- MetInfo CMS = 8.1 weixinreply.class.php PHP Code Injection Vulnerability...
io.github.jeff-tian:keycloak-services-social-weixin (>=0.5.35, <=0.5.40), org.keycloak:keycloak-dependencies-server-all (23.0.0) +6 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-model-jpa (23.0.0)
org.keycloak:keycloak-model-jpa MAVEN version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - io.github.jeff-tian:keycloak-services-social-weixin =0.5.35, =0.5.40 -...
GHSA-444M-PX7R-QPVV weixin4j has Improperly Controlled Sequential Memory Allocation
Improperly Controlled Sequential Memory Allocation vulnerability in foxinmy weixin4j weixin4j-base/src/main/java/com/foxinmy/weixin4j/util modules. This vulnerability is associated with program files CharArrayBuffer.Java, ClassUtil.Java. This issue affects all versions of weixin4j. A path is...
Improperly Controlled Sequential Memory Allocation
Overview com.foxinmy:weixin4j-base is a 垎俥ĺźĺĺşçĄĺˇĽç¨ Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation due to improper control of memory allocation in the CharArrayBuffer and ClassUtil components. An attacker can cause excessive memory consumption ...