[ Vendor · 37 CVEs ]
YesWiki
CVEs affecting YesWiki published in the last 30 days, plus any YesWiki CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-105224 | 4 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering… | |
| CVE-2026-104471 | 2 Oct 2026 | CVSS 7.2 | yeswikiYesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the… | |
| CVE-2026-104472 | 2 Oct 2026 | CVSS 7.5 | yeswikiYesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to… | |
| CVE-2026-104473 | 2 Oct 2026 | CVSS 6.1 | yeswikiYesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through… | |
| CVE-2026-104465 | 2 Oct 2026 | CVSS 6.1 | yeswikiYesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field… | |
| CVE-2026-104466 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post… | |
| CVE-2026-104467 | 2 Oct 2026 | CVSS 8.1 | yeswikiYesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call… | |
| CVE-2026-104468 | 2 Oct 2026 | CVSS 4.8 | yeswikiYesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens… | |
| CVE-2026-104469 | 2 Oct 2026 | CVSS 6.8 | yeswikiYesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not… | |
| CVE-2026-104470 | 2 Oct 2026 | CVSS 5.0 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the… | |
| CVE-2026-104460 | 2 Oct 2026 | CVSS 7.5 | yeswikiYesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into… | |
| CVE-2026-104461 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension… | |
| CVE-2026-104462 | 2 Oct 2026 | CVSS 7.5 | yeswikiYesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw… | |
| CVE-2026-104463 | 2 Oct 2026 | CVSS 7.0 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending… | |
| CVE-2026-104464 | 2 Oct 2026 | CVSS 8.6 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by… | |
| CVE-2026-104453 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by… | |
| CVE-2026-104454 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex… | |
| CVE-2026-104455 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the… | |
| CVE-2026-104456 | 2 Oct 2026 | CVSS 7.6 | yeswikiYesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated… | |
| CVE-2026-104457 | 2 Oct 2026 | CVSS 8.6 | yeswikiYesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes… | |
| CVE-2026-104458 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the… | |
| CVE-2026-104459 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS… | |
| CVE-2026-104448 | 2 Oct 2026 | CVSS 8.1 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET… | |
| CVE-2026-104449 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages… | |
| CVE-2026-104450 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an… | |
| CVE-2026-104451 | 2 Oct 2026 | CVSS 4.3 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions… | |
| CVE-2026-104452 | 2 Oct 2026 | CVSS 5.4 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET… | |
| CVE-2026-104442 | 2 Oct 2026 | CVSS 5.8 | yeswikiYesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch… | |
| CVE-2026-104443 | 2 Oct 2026 | CVSS 8.1 | yeswikiYesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary… | |
| CVE-2026-104444 | 2 Oct 2026 | CVSS 7.1 | yeswikiYesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege… | |
| CVE-2026-104445 | 2 Oct 2026 | CVSS 8.2 | yeswikiYesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer… | |
| CVE-2026-104446 | 2 Oct 2026 | CVSS 6.5 | yeswikiYesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through… | |
| CVE-2026-104447 | 2 Oct 2026 | CVSS 7.1 | yeswikiYesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed… | |
| CVE-2026-104438 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate… | |
| CVE-2026-104439 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered… | |
| CVE-2026-104440 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side… | |
| CVE-2026-104441 | 2 Oct 2026 | CVSS 5.3 | yeswikiYesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch… |