https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T22:40:33.186751+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-104462 fkie_cve-2026-104462 2026-10-03T22:40:33.760132+00:00

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.

 https://vulnerability.circl.lu/vuln/ghsa-mvpf-2445-p988 GHSA-mvpf-2445-p988 2026-10-03T22:40:33.760392+00:00

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.