GHSA-xgx2-332h-9x6q

SQL Injection in Yeswiki

Source: GitHub Advisory Database (reviewed) High CVE-2021-43091

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	yeswiki/yeswiki	< 4.1.0	4.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. The issue was fixed in Yeswiki version 4.1.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-43091 advisory
https://github.com/yeswiki/yeswiki/commit/c9785f9a92744c3475f9676a0d8f95de24750094 web
https://github.com/yeswiki/yeswiki package
https://huntr.dev/bounties/07f245a7-ee9f-4b55-a0cc-13d5cb1be6e0 web