Threats tagged 'ghsa-9vjw-qm94-65hm'

YesWiki versions from 4.6.0 up to but not including 4.7.0 contain an information disclosure vulnerability. This flaw allows unauthenticated attackers to view assembled SQL queries by appending the 'showreq' parameter to public Bazar listing API requests. The disclosed information includes database table names, JSON storage paths, ACL filter logic, and collation details, which could facilitate targeted SQL injection attacks.