CVE-2026-126807

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chatjid=index to list every user's internal I...

CVE-2026-126807 WuzAPI through 1.1.0 Cross-Tenant Information Disclosure via /chat/history

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chatjid=index to list every user's internal I...

CVE-2026-126807

WuzAPI versions up to and including 1.1.0 are vulnerable to a cross-tenant information disclosure flaw within the GetHistory handler. Authenticated users with message history enabled can exploit this by sending a GET request to /chat/history using chat_jid=index. This allows the attacker to view ...

EUVD-2026-124022

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chatjid=index to list every user's internal I...

CVE-2026-126807 WuzAPI through 1.1.0 Cross-Tenant Information Disclosure via /chat/history

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chatjid=index to list every user's internal I...

CVE-2026-126807

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chatjid=index to list every user's internal I...

CVE-2026-126807: asternic wuzapi: WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows…

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chatjid=index to list every user's internal I...

PT-2026-145464

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chat jid=index to list every user's internal...

EUVD-2022-52147

Malicious code in bioql PyPI...

CVE-2022-4889

A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file docroot/publichtml/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is...

CVE-2022-4889 visegripped Stracker api.php getHistory sql injection

A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file docroot/publichtml/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is...

PT-2023-15900 · Unknown · Visegripped Stracker

Name of the Vulnerable Software and Affected Versions: visegripped Stracker affected versions not specified Description: A critical vulnerability was found in visegripped Stracker. The issue affects the getHistory function of the file doc root/public html/stracker/api.php. The manipulation of the...

CVE-2022-4889: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file docroot/publichtml/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...

CVE-2007-6461

Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...

CVE-2007-6461

Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...