CVE-2026-104444

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

EUVD-2026-91455

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444 YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-104444

YesWiki versions before 4.6.7 are vulnerable to an authorization bypass in the comments API editComment route . This flaw allows authenticated low-privilege users to overwrite arbitrary pages or comments by providing their own page as the pagetag field. By sending a POST request to the api/commen...

CVE-2026-104444: Authorization Bypass Through User-Controlled Key

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

PT-2026-104254

YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments...

CVE-2026-76215

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

EUVD-2026-62456

phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attackers can retrieve restricted comment text, commenter email addresses, and attachment filenames for FAQ records they cannot directly access by...

GHSA-RJ4G-RQGH-RX9H Ech0 comment model's Email field returned on public /api/comments endpoints

Summary The Comment model serializes its Email field through the public comment-listing API. internal/model/comment/comment.go:33 uses json:"email", while adjacent PII fields IPHash, UserAgent correctly use json:"-". The public endpoints GET /api/comments?echoid=X and GET...

CVE-2026-40870 Decidim's comments API allows access to all commentable resources

Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level commentable field in the API allows access to all commentable resources within the platform, without any permission checks. All Decidim instances are impacted that hav...

CVE-2026-40870

The CVE affects the Decidim framework: root-level commentable in the API (under /api) lets unauthenticated users access all commentable resources, bypassing permission checks. Affected versions are 0.0.1 up to but not including 0.30.5 and 0.31.1. The issue is fixed in 0.30.5 and 0.31.1. Mitigatio...

EUVD-2012-3430

Malware in sbrugna...

CVE-2012-3473

The 1 reports API and 2 administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions...

Information disclosure

The comments API in application/libraries/api/MYCommentsApiObject.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call...

CVE-2012-3473

The 1 reports API and 2 administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions...

CVE-2012-3474

The comments API in application/libraries/api/MYCommentsApiObject.php in the Ushahidi Platform before 2.5 allows remote attackers to obtain sensitive information about the e-mail address, IP address, and other attributes of the author of a comment via an API function call...

CVE-2012-3473: Improper Authentication

The 1 reports API and 2 administration feature in the comments API in the Ushahidi Platform before 2.5 do not require authentication, which allows remote attackers to generate reports and organize comments via API functions...

PT-2012-4742

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue concerns the Ushahidi Platform, where the reports API and administration feature in the comments API do not require authentication. This allows remote attackers to generate reports...