Threats tagged 'ghsa-hxwq-9qc3-4972'

1 threat

Severity	CVSS	Threat	Source	Published	Score and star
Medium	6.9	CVE-2026-116828YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but Medium6.92026-10-27GCVE DatabaseCVE-2026-116828 YesWiki versions prior to 4.7.0 have a SQL injection vulnerability in the despam.php script. The flaw arises because the 'from' POST parameter is escaped but used in an unquoted INTERVAL context, allowing authenticated administrators to perform blind SQL injection. This can lead to unauthorized reading of database contents, including user password hashes. Report on CVE-2026-116828 Vulnerability CWE-89 #ghsa-hxwq-9qc3-4972	GCVE Database	2026-10-27

Page 1 of 1