CVE-2026-104457

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

CVE-2026-104468

YesWiki versions prior to 4.6.7 are vulnerable to an insufficient session expiration vulnerability (CWE-613). The root cause is that password reset tokens lack expiry timestamps , allowing an attacker to reuse old reset links. If an attacker obtains an unused reset URL from sources such as mailbo...

CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...

CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

EUVD-2026-91473

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

CVE-2026-104462

YesWiki versions before 4.6.7 are vulnerable to an SQL injection within the Bazar nuagetag action. The root cause is the concatenation of unescaped tags attributes into a raw SQL IN clause. Attackers with page-write access (which is unauthenticated on default installations) can inject a tag endin...

CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

CVE-2026-104457

YesWiki versions before 4.6.7 are vulnerable to an SQL injection in the Bazar filtertags action. The vulnerability occurs because the application wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default in...

EUVD-2026-91468

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

CVE-2026-104457 YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

CVE-2026-104457 YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

CVE-2026-104457 YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104439 YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify vali...

CVE-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

EUVD-2026-91426

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

CVE-2026-104415

The Ghost platform (versions 0.7.2 before 6.64.0 ) contains an information disclosure vulnerability within the Admin API . Authenticated users with staff-level privileges can query the Admin API to determine the relative ordering of password hashes belonging to other staff users. While this allow...