CVE-2026-104456

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin...

CVE-2026-104457

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

EUVD-2026-91558

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file editaccounts.php. This manipulation of the argument userid/patientid/physicianid/discountsid/servicesid causes sql injection. Remote...

CVE-2026-104609 onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file editaccounts.php. This manipulation of the argument userid/patientid/physicianid/discountsid/servicesid causes sql injection. Remote...

CVE-2026-104609

A SQL injection vulnerability exists in the onetwothreeneth HospitalManagementSystem (affected versions up to 9ef91ed6007314b6473110ed699dff76d158f61d ). The flaw is located in the get function of the edit_accounts.php file. An attacker can manipulate the user_id , patient_id , physician_id , dis...

CVE-2026-104609 onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file editaccounts.php. This manipulation of the argument userid/patientid/physicianid/discountsid/servicesid causes sql injection. Remote...

CVE-2026-104609 onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file editaccounts.php. This manipulation of the argument userid/patientid/physicianid/discountsid/servicesid causes sql injection. Remote...

CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

CVE-2026-104462

YesWiki versions before 4.6.7 are vulnerable to an SQL injection within the Bazar nuagetag action. The root cause is the concatenation of unescaped tags attributes into a raw SQL IN clause. Attackers with page-write access (which is unauthenticated on default installations) can inject a tag endin...

CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

EUVD-2026-91473

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access unauthenticated on default installs can embed a nuagetag tag ending in a backslash to break quote...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

EUVD-2026-91471

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the newtextsearch action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable...

CVE-2026-104460

Versions of YesWiki prior to 4.6.7 are vulnerable to a blind SQL injection within the {{newtextsearch}} action. The root cause is the concatenation of Bazar list option ids into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without proper escaping. This allows anonymous attackers to plant ...

CVE-2026-104457

YesWiki versions before 4.6.7 are vulnerable to an SQL injection in the Bazar filtertags action. The vulnerability occurs because the application wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default in...

EUVD-2026-91468

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...

CVE-2026-104457 YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN ... clause. Unauthenticated attackers on default installs can save filtertags markup in a page with ...