https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-04T16:32:53.559702+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-104456 fkie_cve-2026-104456 2026-10-04T16:32:53.579492+00:00

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.

 https://db.gcve.eu/vuln/ghsa-m352-5gh7-99x6 GHSA-m352-5gh7-99x6 2026-10-04T16:32:53.579559+00:00

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.