7 Aug 2026, 16:05 UTC80 viewsread 11 August 2026
File
演示站（demo） 客户页面：https://zcard.xxxxsd.cfd 管理页面：https://zcard.xxxxsd.cfd/admin/ [email protected] 123456 https://github.com/NovaWorks/ZCard/ 垃圾开源发卡网的漏洞分享 自己找模板打吧
Channel
HK能量
@hongkongtron
On this record: Growth · Engagement · Posts · Citations · Cite this entry
48subscribers
+0 since we began measuring on 11 August 2026
Risers and fallers across the register · movement among entries of Under 1,000.
Register entry
| Telegram ID | -1002448736407 |
|---|---|
| Type | Channel |
| Username | @hongkongtron |
| Created | Between 1 September 2024 and 31 March 2025 — estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 11 August 2026 |
| Last confirmed live | 2 September 2026 |
| Measurements held | 4 |
| Confirmed unchanged | 2 times, most recently 2 September 2026 |
| On Telegram | t.me/hongkongtron |
Growth
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 26 Aug 2026, 01:05 | 48 | -2 |
| 18 Aug 2026, 11:38 | 50 | +2 |
| 12 Aug 2026, 00:53 | 48 | no change |
| 11 Aug 2026, 09:46 | 48 | first reading |
Engagement
17 posts held, back to 18 July 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 page of Telegram’s post history, 20 posts per page.
Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 17 posts for this entry, the most recent from 7 August 2026. An engagement rate over an empty window would be a number about nothing.
Recent posts
7 Aug 2026, 15:00 UTC31 viewsread 11 August 2026
sub2api 曝OAuth 高危漏洞，仅凭邮箱即可接管账户 sub2api v0.1.171 及之前版本存在一个CVSS 8.8 的高危OAuth 账户接管漏洞。攻击者仅需知道受害者注册邮箱，无需密码或验证码、无需用户交互，即可通过接口将自己的OAuth 身份绑定到受害者账户，完全控制其API 密钥、账单余额与订阅配额。 攻击者利用pending session 流程中existingUser 分支不校验密码和验证码的缺陷，将目标用户ID 设为受害者后完成OAuth 身份绑定。此后攻击者每次OAuth 登录均会解析为受害者账户。 GitHub 问题
4 Aug 2026, 04:02 UTCviews —
HK能量 pinned «出售： ChatGPT Plus 成品/代充/卡密 ChatGPT 5x 20x 成品/代充/卡密 Cursor Pro/Pro+/Ultra Cursor Pro Auto Claude Pro/5x/20x SuperGrok/SuperGrok Heavy 购买提前咨询 @pjsvip»
4 Aug 2026, 04:02 UTC41 viewsread 11 August 2026
File
Gadget 链本身通常没有 CVE TemplatesImpl、JdbcRowSetImpl、BCEL、ibatis JNDI 等是利用组件，不是 fastjson 单独 CVE。 fastjson2 < 2.0.63 长亭报的 AutoType 加固问题，默认不开 autoType 不受影响，很多扫描器也不会标。 ──────────────────── 和「有 CVE」怎么对应（扫漏洞时容易漏） 扫到 fastjson 1.2.47 + 只匹配 CVE-2022-25845 → 可能漏掉：1.2.47 专用 cache 投毒（无独立 CVE） 扫到 fastjson 1.2.68 + 只匹配 CVE-2026-16723 → 可能漏掉：expectClass 绕过（另一条链，无 CVE） 扫到 fastjson 1.2.80 + 无 CVE 命中 → …
4 Aug 2026, 02:08 UTC34 viewsread 11 August 2026
出售： ChatGPT Plus 成品/代充/卡密 ChatGPT 5x 20x 成品/代充/卡密 Cursor Pro/Pro+/Ultra Cursor Pro Auto Claude Pro/5x/20x SuperGrok/SuperGrok Heavy 购买提前咨询 @pjsvip
3 Aug 2026, 02:11 UTC38 viewsread 11 August 2026
mail.bcommerce.cl:587 (TLS) 账号 │ [email protected] 密码 │ *jn&(E]4Xf*n
3 Aug 2026, 01:25 UTC38 viewsread 11 August 2026
www.iosrreport.org（IOSR 学术报告/证书邮政后台） https://iosrreport.org/post.iosrreport.org/backend/web/index.php?r=site/login 管理员账号 username：post password：BLQwYDYzhgnkg3@
3 Aug 2026, 00:58 UTC35 viewsread 11 August 2026
平台说明 平台名称：Sinapsis Club 域名：sinapsis.club / www.sinapsis.club 业务：哥伦比亚 K12 在线教育平台（学校、学生、教师、课 程、测评、教学序列） 技术：PHP Yii2 2.0.8 版权方：Editorial Mango（页脚品牌） 服务器：162.214.115.167，路径 /home/wwsina/public_html/sinapsisclub 后台登录链接（一行一个） http://sinapsis.club/web/index.php/user/security/logi n http://www.sinapsis.club/web/index.php/user/security/ login http://sinapsis.club/web/index.php/site/index http://…
3 Aug 2026, 00:52 UTC31 viewsread 11 August 2026
File
平台：Escuela de Idiomas Headway 教务管理系统（哥伦比亚语言学校） 后台登录链接： https://www.escueladeidiomasheadway.com/proyecthw/web /index.php?r=site/login 管理员账号： 98620321 管理员密码： EIHeadway 共 12,212 条学生记录 支付记录 99,950 条 财务流水约 77 亿哥伦比亚比索 (COP)
3 Aug 2026, 00:44 UTC29 viewsread 11 August 2026
平台名称：Sinapsis Club（sinapsis.club / www.sinapsis.club） 业务类型：在线教育 / 学习管理平台（哥伦比亚学校场景： 学生、教师、课程、教学序列、测评、档案等） 后台登录链接（完整） 主登录页（所有角色统一入口）： http://sinapsis.club/web/index.php/user/security/logi n http://www.sinapsis.club/web/index.php/user/security/ login 直连 IP（需带 Host，推荐）： http://162.214.115.167/web/index.php/user/security/lo gin 请求头：Host: sinapsis.club 登录后后台首页： http://sinapsis.club/web/index…
2 Aug 2026, 23:34 UTC41 viewsread 11 August 2026
https://imcpas.id/runtime/logs/ 摘要如下： ────────────── 目标 imcpas.id（119.235.21.230）— 印尼 Pt Pasopati 的 Yii2 VoIP/计费系统（监狱/机构通话计费） ─────────────────────────── 已确认漏洞 1. 目录浏览（致命） — /runtime/logs/、/runtime/export/、/runtime/debug 、/config/、/vendor/、/controllers/等均可列目录 2. 日志泄露凭据 — app.log 含完整 $_POST，挖出 81 组真实账号密码 3. 通话详单 PII 泄露 — /runtime/export/ 大量CSV（手机号、PIN、分机号） 4. Yii Debug 数据公开 — .data文件无鉴权可读 5. 生产…
1 Aug 2026, 00:55 UTC69 viewsread 11 August 2026
File
一、gamepg-src.tgz（完整线上源码） 项目是什么 PG 电子游戏 + Telegram 机器人运营平台。用户通过 Telegram Bot 玩 PG Soft、PP、FC、JDB 等第三方游戏，钱包充值/提现走 OkPay 等支付通道。后台标题为「PG游戏-后台管理」，域名 https://gamepg.pginvest.one/。 前后端是否完整 相对完整，属于 PHP 单体全栈，不是前后端分离仓库。 • 后端：ThinkPHP 6 多应用，含 vendor/ 依赖，可直接部署运行。 • 管理端前端：内置在 public/components/admin/，基于 vuecms/vueadmin（Layui + Vue 组件），由 PHP 渲染页面 + JS 组件，不是单独的 Vue CLI 工程。 • 用户端：没有独立 H5/App 前端…
Showing the 12 most recent of 17 posts we hold for @hongkongtron. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
Forward network
Republished by
Channels on the register that have forwarded this channel's posts into their own feed.
Built only from forwarded posts we have actually read, on both sides. Coverage is early and deliberately incomplete: a missing link means we have not read the post that would prove it, never that the relationship does not exist. Counts are distinct forwarded posts observed, so they only ever go up as we read more.
Mentions
Names
Channels on the register whose handles appear in this channel's posts.
A mention is a weaker signal than a forward and is counted separately for that reason — naming a channel is not republishing it, and a handle in a post body is easy to place deliberately. The post counts beside each row below are distinct posts in which the handle appeared, from posts we have read on both sides — the “Named by N registered channels” figure above is a different count, of distinct NAMING CHANNELS rather than posts, and is not the sum of the rows under it.
Cite this entry
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 26 August 2026 — this entry's latest reading, not the date you are reading this.
“HK能量” (@hongkongtron), 48 subscribers as measured 26 August 2026. Telegram Register, tgregister.com/channel/hongkongtron.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.