Yeswiki vulnerabilities

Products

• Yeswiki 85

Newest

• yeswiki YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand CVE-2026-116828 6.9 MediumOctober 26, 2026
• yeswiki YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import CVE-2026-116827 8.2 HighOctober 26, 2026
• yeswiki YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile CVE-2026-116826 8.2 HighOctober 26, 2026
• yeswiki YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox CVE-2026-116825 8.3 HighOctober 26, 2026
• yeswiki YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler CVE-2026-116824 5.3 MediumOctober 26, 2026
• yeswiki YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback CVE-2026-116823 5.3 MediumOctober 26, 2026
• yeswiki YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter CVE-2026-116822 6.9 MediumOctober 26, 2026
• yeswiki YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames CVE-2026-116821 7.1 HighOctober 26, 2026
• yeswiki YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter CVE-2026-116820 6.9 MediumOctober 26, 2026
• yeswiki YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create CVE-2026-116211 8.8 HighOctober 25, 2026
• yeswiki YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts CVE-2026-116208 7.2 HighOctober 25, 2026
• yeswiki YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API CVE-2026-116207 8.8 HighOctober 25, 2026
• yeswiki YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax CVE-2026-116206 5.3 MediumOctober 25, 2026
• yeswiki YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax CVE-2026-116205 6.9 MediumOctober 25, 2026
• yeswiki YesWiki before 4.7.0 CSRF via despam Admin Action CVE-2026-116204 7.2 HighOctober 25, 2026
• yeswiki YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters CVE-2026-116203 5.3 MediumOctober 25, 2026
• yeswiki YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload CVE-2026-116202 5.1 MediumOctober 25, 2026
• yeswiki YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler CVE-2026-104472 8.7 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import CVE-2026-104471 8.6 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Stored XSS via Bazar valeur Action CVE-2026-105224 5.1 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter CVE-2026-104470 5.3 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Session Fixation via Login in AuthController.php CVE-2026-104469 7.6 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction CVE-2026-104468 6.3 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Authorization Bypass via Public API Mode CVE-2026-104467 9.2 CriticalOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute CVE-2026-104466 5.1 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler CVE-2026-104465 5.1 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter CVE-2026-104464 8.8 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox CVE-2026-104463 8.3 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter CVE-2026-104462 8.8 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField CVE-2026-104461 5.1 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch CVE-2026-104460 8.7 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle CVE-2026-104459 6.9 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses CVE-2026-104458 8.3 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter CVE-2026-104457 8.8 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username CVE-2026-104456 7.2 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action CVE-2026-104455 6.9 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint CVE-2026-104454 6.9 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action CVE-2026-104453 5.3 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler CVE-2026-104452 5.3 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler CVE-2026-104451 5.3 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action CVE-2026-104450 8.2 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche CVE-2026-104449 8.3 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler CVE-2026-104448 7.2 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction CVE-2026-104447 7.1 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler CVE-2026-104446 6.9 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing CVE-2026-104445 8.8 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Authorization Bypass via Comments API editComment CVE-2026-104444 7.1 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Scope Bypass via Triples Delete API CVE-2026-104443 7.2 HighOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action CVE-2026-104442 6.9 MediumOctober 2, 2026
• yeswiki YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action CVE-2026-104441 6.9 MediumOctober 2, 2026
• Show olderLoading…