GitHub Advisoryadvisory · Packagist

GHSA-xgx2-332h-9x6q SQL Injection in Yeswiki

HIGH Published 2022-03-26 Modified 2022-03-30 Official page ↗
Aliases
CVE-2021-43091
Ecosystem
Packagist
Packages
yeswiki/yeswiki
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-89
Reviewed
2022-03-30

Affected packages

• Packagist yeswiki/yeswiki: < 4.1.0 → fixed in 4.1.0

Description

An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. The issue was fixed in Yeswiki version 4.1.0.

Related

Alias · CVE (1)

  • CVE-2021-43091 An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References