YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

Vulnerability Details YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data'idfiche' value sourced from $POST'idfiche' is concatenated directly into a raw SQL query without any sanitization or parameterization. Vulnerable Code...

PT-2026-37109

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.1 Description The bazar module contains a SQL injection flaw in the tools/bazar/services/EntryManager.php file. The issue occurs because the id fiche value, sourced from the $ POST'id fiche' variable, is...

EUVD-2018-4995

Malware in sbrugna...

EUVD-2022-37887

Malicious code in bioql PyPI...

EUVD-2022-52362

Malicious code in bioql PyPI...

CVE-2022-34989

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

CVE-2022-30478

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in \searchproduct.php via the keyword parameters...

YesWiki 跨站脚本漏洞

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative manner. A cross-site scripting vulnerability exists in YesWiki versions prior to 4.5.4, which stems from a cross-site scripting attack on the /?BazaR endpoint an...

bazar-roudnice.cz Cross Site Scripting vulnerability OBB-3901304

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bazar-roudnice.cz Cross Site Scripting vulnerability OBB-3894996

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bazar-roudnice.cz Cross Site Scripting vulnerability OBB-3418537

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bazar-roudnice.cz Cross Site Scripting vulnerability OBB-3405399

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bazar-cz.cz Cross Site Scripting vulnerability OBB-3250383

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-34989

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

CVE-2022-34989

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

CVE-2022-34989

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

Sql injection

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

CVE-2022-34989

CVE-2022-34989 impacts Fruits Bazar v1.0, where a SQL injection vulnerability exists in the recover_email parameter of the table/user_password_recover.php. The NVD entry assigns a CVSS3.1 base score of 9.8 (CRITICAL) with network access, no user interaction, and no privileges required, affecting ...

CVE-2022-34989

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

PT-2022-22473 · Unknown · Fruits Bazar

Name of the Vulnerable Software and Affected Versions: Fruits Bazar version 1.0 Description: A SQL injection issue was found in Fruits Bazar via the recover email parameter at the "user password recover.php" endpoint. Recommendations: For Fruits Bazar version 1.0, as a temporary workaround,...