710 matches found
CVE-2021-43091
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form...
CVE-2021-43091
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form...
CVE-2021-43091
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form...
Sql injection
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form...
CVE-2021-43091
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form...
CVE-2021-43091
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form...
CVE-2021-43091
YesWiki doryphore 20211012 is affected by an SQL injection in the email parameter of the registration form. Exploitation details are not provided in the documents, but multiple sources confirm an SQL injection vulnerability in this version. CVSS metrics indicate medium (CVSS2 base 5.0) and high (...
PT-2022-11777
Name of the Vulnerable Software and Affected Versions Yeswiki versions prior to 4.1.0 Description An SQL Injection issue exists in Yeswiki via the email parameter in the registration form. Recommendations For versions prior to 4.1.0, update to version 4.1.0 to resolve the issue. As a temporary...
YesWiki SQL注入漏洞
YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative way. A SQL injection vulnerability exists in Yes Wiki doryphore version 20211012, which originates from a SQL injection vulnerability in the email parameter of t...
CVE-2021-43091: Improper Neutralization of Special Elements used in an SQL Command
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form...
Cross-site Scripting (XSS) - Stored in yeswiki/yeswiki
Description Stored XSS when Add a new entry for Forum Proof of Concept // PoC.req POST /doryphore/?BazaR&vue=saisir&action=saisirfiche&id=2 HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:96.0 Gecko/20100101 Firefox/96.0 Accept:...
Cross-site Scripting (XSS) - Reflected in yeswiki/yeswiki
Description Hey all, i found that the search function of YesWiki integrates the searched term into a value attribute inside an input tag, for example if i do a search on sneaky for example, it will put the term sneaky inside a value attribute: html now if i add a double quote to the searched term...
Cross-Site Request Forgery (CSRF) in yeswiki/yeswiki
Description Hey all, so i found that YesWiki doesn't implement any sort of anti-csrf mechanism, i found that the change email function is vulnerable to CSRF attacks which leads to Account Takeover. Proof of Concept Exploitation Scenario: - An attacker sends the above PoC to the victim. - rather...
SQL Injection in yeswiki/yeswiki
Description A boolean-based SQL Injection vulnerability has been found in the email parameter of the registration form. When a new user registers, the application first checks if the email exists through the emailExistsInDB function located in line 999 of the User.class.php. As you can see, it do...
in yeswiki/yeswiki
Description Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. Using a file upload helps the attacker to inject javascript code via SVG...
SQL Injection in yeswiki/yeswiki
Description A SQL injection attack consists of insertion or 'injection' of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations ...
YesWiki cercopitheque 2020.04.18.1 - (id) SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: YesWiki cercopitheque 2020.04.18.1 - 'id' SQL Injection Exploit Author: coiffeur Vendor Homepage: https://yeswiki.net/ Software Link: https://yeswiki.net/, https://github.com/YesWiki/yeswiki Version: YesWiki cercopitheque...
YesWiki cercopitheque 2020.04.18.1 - 'id' SQL Injection
Exploit Title: YesWiki cercopitheque 2020.04.18.1 - 'id' SQL Injection Date: 2020-04-25 Exploit Author: coiffeur Vendor Homepage: https://yeswiki.net/ Software Link: https://yeswiki.net/, https://github.com/YesWiki/yeswiki Version: YesWiki cercopitheque OPTIONS... DESCRIPTION: -lt, list tables. -...
YesWiki cercopitheque 2020.04.18.1 SQL Injection
Exploit Title: YesWiki cercopitheque 2020.04.18.1 - 'id' SQL Injection Date: 2020-04-25 Exploit Author: coiffeur Vendor Homepage: https://yeswiki.net/ Software Link: https://yeswiki.net/, https://github.com/YesWiki/yeswiki Version: YesWiki cercopitheque OPTIONS... DESCRIPTION: -lt, list tables. -...