https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T23:48:21.408925+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-104456 fkie_cve-2026-104456 2026-10-03T23:48:21.412137+00:00

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.

 https://vulnerability.circl.lu/vuln/ghsa-m352-5gh7-99x6 GHSA-m352-5gh7-99x6 2026-10-03T23:48:21.412237+00:00

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.