https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-11T19:14:45.714680+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-123617 CVE-2026-123617 — Openwhyd before 1.65.1 NoSQL Injection via POST /api/user 2026-11-11T19:14:45.716672+00:00

Affected: openwhyd

Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate user lookups by passing JSON objects in the id parameter. Attackers can send MongoDB query operators such as $ne or $gt to POST /api/user to select and enumerate other users' public profile records.