# yeswiki.

Every CVE that names yeswiki among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand](https://agentprime.io/advisories/CVE-2026-116828.md)
  `CVE-2026-116828` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection
- [YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import](https://agentprime.io/advisories/CVE-2026-116827.md)
  `CVE-2026-116827` · CVE record: YesWiki yeswiki · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile](https://agentprime.io/advisories/CVE-2026-116826.md)
  `CVE-2026-116826` · CVE record: YesWiki yeswiki · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox](https://agentprime.io/advisories/CVE-2026-116825.md)
  `CVE-2026-116825` · CVE record: YesWiki yeswiki · CVSS 8.3 High · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler](https://agentprime.io/advisories/CVE-2026-116824.md)
  `CVE-2026-116824` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.7.0 Reflected XSS via BazarField $\_REQUEST Fallback](https://agentprime.io/advisories/CVE-2026-116823.md)
  `CVE-2026-116823` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter](https://agentprime.io/advisories/CVE-2026-116822.md)
  `CVE-2026-116822` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames](https://agentprime.io/advisories/CVE-2026-116821.md)
  `CVE-2026-116821` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection
- [YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter](https://agentprime.io/advisories/CVE-2026-116820.md)
  `CVE-2026-116820` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-215
- [YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create](https://agentprime.io/advisories/CVE-2026-116211.md)
  `CVE-2026-116211` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: SQL injection
- [YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts](https://agentprime.io/advisories/CVE-2026-116208.md)
  `CVE-2026-116208` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API](https://agentprime.io/advisories/CVE-2026-116207.md)
  `CVE-2026-116207` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: SQL injection
- [YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax](https://agentprime.io/advisories/CVE-2026-116206.md)
  `CVE-2026-116206` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.7.0 Unauthenticated SSRF via \[\[|URL\]\] Raw-Inclusion Syntax](https://agentprime.io/advisories/CVE-2026-116205.md)
  `CVE-2026-116205` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.7.0 CSRF via despam Admin Action](https://agentprime.io/advisories/CVE-2026-116204.md)
  `CVE-2026-116204` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters](https://agentprime.io/advisories/CVE-2026-116203.md)
  `CVE-2026-116203` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload](https://agentprime.io/advisories/CVE-2026-116202.md)
  `CVE-2026-116202` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Stored XSS via Bazar valeur Action](https://agentprime.io/advisories/CVE-2026-105224.md)
  `CVE-2026-105224` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler](https://agentprime.io/advisories/CVE-2026-104472.md)
  `CVE-2026-104472` · CVE record: YesWiki yeswiki · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import](https://agentprime.io/advisories/CVE-2026-104471.md)
  `CVE-2026-104471` · CVE record: YesWiki yeswiki · CVSS 8.6 High · Not analysed yet · Published 2 Oct 2026 · Tags: Unrestricted file upload
- [YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter](https://agentprime.io/advisories/CVE-2026-104470.md)
  `CVE-2026-104470` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 Session Fixation via Login in AuthController.php](https://agentprime.io/advisories/CVE-2026-104469.md)
  `CVE-2026-104469` · CVE record: YesWiki yeswiki · CVSS 7.6 High · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction](https://agentprime.io/advisories/CVE-2026-104468.md)
  `CVE-2026-104468` · CVE record: YesWiki yeswiki · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [YesWiki before 4.6.7 Authorization Bypass via Public API Mode](https://agentprime.io/advisories/CVE-2026-104467.md)
  `CVE-2026-104467` · CVE record: YesWiki yeswiki · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute](https://agentprime.io/advisories/CVE-2026-104466.md)
  `CVE-2026-104466` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler](https://agentprime.io/advisories/CVE-2026-104465.md)
  `CVE-2026-104465` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter](https://agentprime.io/advisories/CVE-2026-104464.md)
  `CVE-2026-104464` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox](https://agentprime.io/advisories/CVE-2026-104463.md)
  `CVE-2026-104463` · CVE record: YesWiki yeswiki · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter](https://agentprime.io/advisories/CVE-2026-104462.md)
  `CVE-2026-104462` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField](https://agentprime.io/advisories/CVE-2026-104461.md)
  `CVE-2026-104461` · CVE record: YesWiki yeswiki · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch](https://agentprime.io/advisories/CVE-2026-104460.md)
  `CVE-2026-104460` · CVE record: YesWiki yeswiki · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle](https://agentprime.io/advisories/CVE-2026-104459.md)
  `CVE-2026-104459` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses](https://agentprime.io/advisories/CVE-2026-104458.md)
  `CVE-2026-104458` · CVE record: YesWiki yeswiki · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter](https://agentprime.io/advisories/CVE-2026-104457.md)
  `CVE-2026-104457` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username](https://agentprime.io/advisories/CVE-2026-104456.md)
  `CVE-2026-104456` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection
- [YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action](https://agentprime.io/advisories/CVE-2026-104455.md)
  `CVE-2026-104455` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure
- [YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint](https://agentprime.io/advisories/CVE-2026-104454.md)
  `CVE-2026-104454` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service
- [YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action](https://agentprime.io/advisories/CVE-2026-104453.md)
  `CVE-2026-104453` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler](https://agentprime.io/advisories/CVE-2026-104452.md)
  `CVE-2026-104452` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler](https://agentprime.io/advisories/CVE-2026-104451.md)
  `CVE-2026-104451` · CVE record: YesWiki yeswiki · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action](https://agentprime.io/advisories/CVE-2026-104450.md)
  `CVE-2026-104450` · CVE record: YesWiki yeswiki · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche](https://agentprime.io/advisories/CVE-2026-104449.md)
  `CVE-2026-104449` · CVE record: YesWiki yeswiki · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler](https://agentprime.io/advisories/CVE-2026-104448.md)
  `CVE-2026-104448` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction](https://agentprime.io/advisories/CVE-2026-104447.md)
  `CVE-2026-104447` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler](https://agentprime.io/advisories/CVE-2026-104446.md)
  `CVE-2026-104446` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing](https://agentprime.io/advisories/CVE-2026-104445.md)
  `CVE-2026-104445` · CVE record: YesWiki yeswiki · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [YesWiki before 4.6.7 Authorization Bypass via Comments API editComment](https://agentprime.io/advisories/CVE-2026-104444.md)
  `CVE-2026-104444` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Scope Bypass via Triples Delete API](https://agentprime.io/advisories/CVE-2026-104443.md)
  `CVE-2026-104443` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action](https://agentprime.io/advisories/CVE-2026-104442.md)
  `CVE-2026-104442` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action](https://agentprime.io/advisories/CVE-2026-104441.md)
  `CVE-2026-104441` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter](https://agentprime.io/advisories/CVE-2026-104440.md)
  `CVE-2026-104440` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [YesWiki before 4.6.7 User Enumeration via Lost-Password Flow](https://agentprime.io/advisories/CVE-2026-104439.md)
  `CVE-2026-104439` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-204
- [YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions](https://agentprime.io/advisories/CVE-2026-104438.md)
  `CVE-2026-104438` · CVE record: YesWiki yeswiki · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=yeswiki>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/yeswiki/>. Everything for agents: <https://agentprime.io/llms.txt>.