https://vulnerability.circl.lu/sightings/feed 2026-05-30T01:39:50.447897+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/8613149d-d8cb-4ff9-a252-09e1a34aa677/export 2026-05-30T01:39:50.831913+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "8613149d-d8cb-4ff9-a252-09e1a34aa677", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-23654", "type": "published-proof-of-concept", "source": "https://t.me/cibsecurity/37901", "content": "\u203c CVE-2022-23654 \u203c\n\nWiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b fixes this vulnerability by checking access control on the path associated with the page ID instead of the user-provided value. When the path is different than the current value, a second access control check is then performed on the user-provided path before the move operation.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-22T22:12:45.000000Z"} 2022-02-22T22:12:45+00:00