Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 8.8 | CVE-2026-116211 |
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116211YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated...
Executive summaryYesWiki versions from 4.5.0 before 4.7.0 contain an SQL injection flaw in the Bazar entry creation feature, where a date field from the request is inserted into a database query without escaping. The advisory rates it High with a CVSS score of 8.2 and says the fix is in version 4.7.0, so users should upgrade to 4.7.0 or later. Technical summaryThe flaw is CWE-89 SQL injection in PageManager::save(), where the date_maj_fiche POST field is concatenated raw into an INSERT SET statement via the forcedDate parameter instead of being escaped like the other columns. The advisory describes a network attack with low complexity and no privileges required on the authenticated path, and says an unauthenticated path via action=saisir_fiche works on a default install, with confidentiality impact rated High. Affected versions are stated as >= 4.5.0, < 4.7.0 in the package data and <= 4.6.7 in the description, and the patched version is 4.7.0. The advisory suggests escaping $forcedDate at the sink or validating date_maj_fiche as a strict datetime, but does not state any other workaround. Detection guidance is not stated, and whether the flaw is exploited in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.2 | CVE-2026-116208 |
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116208YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other...
Executive summaryYesWiki, a wiki package used with ActivityPub federation, has a missing authorization flaw in its sync feature. A malicious federated server can cause a YesWiki administrator's routine sync to delete, overwrite, or create entries that belong to other federated actors. The advisory rates it High (8.1 CVSS) and states the fix status is not fixed, with the affected range given as versions 4.6.2 through 4.6.7; the advisory does not state a patched version for the sync path. Technical summaryThe flaw is CWE-862 (missing authorization) in ActivityPubService::syncActorPosts, which processes Delete, Update, and Create activities from a remote outbox without the assertOwns() and sameHost() checks used by the inbox handler, and runs a host-scoped garbage-collection delete. Exploitation requires an administrator to trigger the sync action (a GET request with no CSRF token), and the attacker needs no privileges on the wiki; the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. The advisory lists the affected range as >= 4.6.2 and <= 4.6.7 in the body, while the metadata says '< 4.7.0' and the patched version is listed as 4.7.0, but it also says the fix status is 'not fixed' for the sync path. Workarounds are stated as avoiding sync with untrusted actors and adding a CSRF token to the sync action, which the advisory suggests but does not confirm as implemented. No detection guidance is stated, and no exploitation in the wild is stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cr64-h6xp-9g2j Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.8 | CVE-2026-116207 |
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest()
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116207YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest()
Executive summaryYesWiki, a wiki platform, has a critical flaw that lets anyone on the network read data from its database, including user credentials, without logging in. It can also be used to make the site unavailable by overloading the database. The advisory recommends updating to 4.7.0 or 5.0.0-alpha4, and restricting network access to the public Bazar entries API until then. Technical summaryThe flaw is an unauthenticated SQL injection (CWE-89) in the Bazar entries search API, reachable through GET /api/forms/{formId}/entries and /api/entries/bazarlist. A backtick in the query or searchfields field name breaks out of a backtick-quoted SQL alias, because the code uses mysqli_real_escape_string, which does not escape backticks. Injected SELECT subqueries can read any table the database user can access, and results are returned in the JSON response, while SLEEP-based subqueries can exhaust database connections. The advisory states the vector is network with low complexity and no privileges or user interaction, and gives CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H with a score of 9.1. Fixed versions are stated as 4.7.0 and 5.0.0-alpha4, while the affected range is inconsistently described as 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 in one place and as 4.6.7 through 5.0.0-alpha3 in the detailed text. Recommended interim mitigation is restricting network access to the public Bazar endpoints. Detection guidance is not stated, and no in-the-wild exploitation is mentioned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-116206 |
YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116206YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka...
Executive summaryYesWiki, a wiki package distributed through Composer, has a stored cross-site scripting flaw affecting versions from 4.2.0 up to but not including 4.7.0. The advisory rates it Moderate (CVSS 6.4) and says any logged-in user who can comment on a page can run scripts in the browsers of everyone who views that page, including administrators. The advisory lists 4.7.0 as the patched version, but its body says no fix exists in any published release, so administrators should confirm the status with the vendor before relying on an upgrade. Technical summaryThe flaw is CWE-79 stored cross-site scripting in comment bodies. Comments are saved with only whitespace trimming and are rendered with the Twig raw filter, and the wiki raw-HTML syntax is enabled by default through allow_raw_html set to true, so any authenticated user with comment access on a page can inject script through POST /api/comments. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, and the advisory says no user interaction beyond viewing the page is needed. The header lists affected versions as >= 4.2.0, < 4.7.0 and patched version as 4.7.0, but the body says the confirmed affected range is >= 4.2.0, <= 4.6.7 and that the fix status is not fixed. The advisory suggests sanitizing comment bodies at storage or setting allow_raw_html to false as an interim step, but it does not state a fixed release that the body confirms. No detection guidance or indicators of exploitation in the wild are stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wq96-vjjh-hfc6 Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2026-116205 |
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116205YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki...
Executive summaryYesWiki versions before 4.7.0 contain an unauthenticated server-side request forgery flaw. Any anonymous visitor can make the YesWiki server fetch arbitrary internal or external URLs and read the responses back. The advisory rates it Moderate with a CVSS 3.1 base score of 5.3, and the fix is to upgrade to version 4.7.0. Technical summaryThe flaw is CWE-918 server-side request forgery in the wiki raw-inclusion syntax [[|URL]], which fetches attacker-supplied URLs without scheme, host, or IP validation and echoes the response body. It is reachable without authentication through the page render handler using the content parameter, and also stored via a page body saved by a registered editor that fires when anonymous visitors view it. The advisory states the affected versions are less than 4.7.0 and the patched version is 4.7.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. A workaround is not stated, and no detection guidance beyond the proof of concept's access log observation is provided. No CVE ID is listed in the advisory, and exploitation in the wild is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.2 | CVE-2026-116204 |
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116204YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or...
Executive summaryYesWiki, a wiki package distributed through Composer, has a cross-site request forgery flaw in its admin despam action. An unauthenticated attacker who gets a logged-in administrator to view a planted wiki page could permanently delete pages or restore old revisions, with the front page and configuration pages at risk. The advisory rates it High (CVSS 8.1) and recommends adding CSRF token checks, but it contradicts itself on which versions are fixed. Technical summaryThe flaw is CWE-352 in tools/security/actions/despam.php, where the destructive clean (suppr[]) and revision-restore (rev[]) branches are guarded only by a session-based UserIsAdmin() check, with no CSRF token, Origin, or Referer verification. The advisory describes the attack as requiring default configuration (default_write_acl='*', allow_raw_html=true), an attacker-created wiki page containing an auto-submitting form, and an administrator visiting that page; the session cookie's SameSite=Lax setting still allows the same-site POST. Affected versions conflict within the advisory: the header lists affected versions as before 4.7.0 with patched version 4.7.0, while the body states a confirmed affected range of <= 4.6.8 and says the fix status is not fixed. The advisory also says the v5 pre-release 5.0.0.0-alpha3 is affected, though it is outside the stable range it scopes. The stated CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H with a base score of 8.1. Recommended fixes are to require a CSRF token on the clean and revision-restore branches, with CSP script-src and form-action 'self' and a permissions.action entry for despam as defense-in-depth. Detection guidance and exploitation in the wild are not stated, and the advisory notes no CVE is assigned. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cv88-hx5q-vq72 Impact if exploitedConfidentialityNone IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-116203 |
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116203YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding
Executive summaryYesWiki versions before 4.7.0 contain a stored cross-site scripting flaw in the filtertags action. An anonymous visitor who can create or edit a page could store script that runs for every later viewer of that page. The advisory rates it High and says the fix is to upgrade to version 4.7.0. Technical summaryThe flaw is stored cross-site scripting (CWE-79) in the filtertags action, where attacker-controlled token values are echoed into page HTML without output encoding, including the button inner text, the title parameter, and the tagbadges value. The payload is injected through the action attribute syntax, which the wakka formatter processes before its allow_raw_html check, so it bypasses that control. Preconditions stated are that default page ACLs on a fresh install are read=* and write=*, and the advisory reports anonymous exploitation using a hashcash token fetched without authentication. Affected versions are stated as before 4.7.0 and the patched version as 4.7.0. The advisory does not state a workaround. It recommends output-encoding the echo sites in tools/tags/actions/filtertags.php. Detection guidance is not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f53x-3gqx-xq76 Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-116202 |
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-116202YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar...
Executive summaryA stored cross-site scripting flaw in YesWiki lets a low-privilege authenticated user upload a malicious SVG file through an image field, and the script runs for people who open the entry or the stored file. The advisory says the earlier fix for a related form-upload issue did not cover this image field, so the flaw remains on the patched version. The advisory lists the affected version as before 4.7.0 and the patched version as 4.7.0, and it recommends applying the same upload sanitization to the image field. Technical summaryThis is a stored cross-site scripting issue (CWE-79) caused by unrestricted SVG upload through the ImageField class in tools/bazar/fields/ImageField.php, which stores files without the sanitizer that the sibling FileField class received in the earlier fix. The attacker needs a valid authenticated account (PR:L) and user interaction (UI:R), and posts a multipart request to /api/entries/{formId} with an SVG file that is then served as image/svg+xml on the wiki origin. The advisory states the affected versions as less than 4.7.0 and the patched version as 4.7.0, and it says the fix for this specific field is not yet present. No workaround is stated. No detection guidance is stated beyond the proof-of-concept description. The advisory does not state any exploitation in the wild or a CVSS score. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from https://github.com/YesWiki/yeswiki/security/advisories/GHSA-c5q6-7233-3v6g Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-105224 |
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-105224YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from...
From the advisoryYesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-104473 |
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104473YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as...
From the advisoryYesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-104472 |
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104472YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs
From the advisoryYesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages. Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.6 | CVE-2026-104471 |
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104471YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via...
From the advisoryYesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.3 | CVE-2026-104470 |
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104470YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar...
From the advisoryYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 7.6 | CVE-2026-104469 |
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104469YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID
From the advisoryYesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.3 | CVE-2026-104468 |
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104468YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps
From the advisoryYesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Critical | 9.2 | CVE-2026-104467 |
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104467YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when...
From the advisoryYesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives. Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-104466 |
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104466YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers...
From the advisoryYesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators. Impact if exploitedConfidentialityLow IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-104465 |
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104465YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler
From the advisoryYesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.8 | CVE-2026-104464 |
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104464YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated...
From the advisoryYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries. Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.3 | CVE-2026-104463 |
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104463YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities...
From the advisoryYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests. Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.8 | CVE-2026-104462 |
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104462YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause
From the advisoryYesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data. Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 5.1 | CVE-2026-104461 |
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104461YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls...
From the advisoryYesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise. Impact if exploitedConfidentialityNone IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.7 | CVE-2026-104460 |
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104460YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in...
From the advisoryYesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table. Impact if exploitedConfidentialityHigh IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Medium | 6.9 | CVE-2026-104459 |
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104459YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts
From the advisoryYesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports. Impact if exploitedConfidentialityLow IntegrityNone AvailabilityLow
How it is exploited
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| High | 8.3 | CVE-2026-104458 |
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4,...
YesWikiyeswiki
|
NVD | |||
|
CVE-2026-104458YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4,...
From the advisoryYesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts. Impact if exploitedConfidentialityHigh IntegrityLow AvailabilityNone
How it is exploited
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||