https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:57:02 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-103513 cnvd-2021-103513 https://cve.radiocsirt.org/vuln/cnvd-2021-103513 https://cve.radiocsirt.org/vuln/euvd-2026-21323 EUVD-2026-21323 https://cve.radiocsirt.org/vuln/euvd-2026-21323 https://cve.radiocsirt.org/vuln/fkie_cve-2021-4119 <p>bookstack is vulnerable to Improper Access Control</p> <p>bookstack is vulnerable to Improper Access Control</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-4119 https://cve.radiocsirt.org/vuln/ghsa-9c5c-5j4h-8q2c <p><strong>Affected:</strong> Packagist: ssddanbrown/bookstack</p> <p>BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(`email`, `like`, `%` . $search . `%`) to search for users based on email.</p> <p><strong>Affected:</strong> Packagist: ssddanbrown/bookstack</p> <p>BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(`email`, `like`, `%` . $search . `%`) to search for users based on email.</p> https://cve.radiocsirt.org/vuln/ghsa-9c5c-5j4h-8q2c https://cve.radiocsirt.org/vuln/gsd-2021-4119 gsd-2021-4119 https://cve.radiocsirt.org/vuln/gsd-2021-4119