Advisories · Technology

yeswiki.

Every CVE that names yeswiki among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-116828 CVE record

CVSS 6.9 Medium

YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
- yeswiki
- SQL injection
Not analysed yet 26 Oct 2026
CVE-2026-116827 CVE record

CVSS 8.2 High

YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 26 Oct 2026
CVE-2026-116826 CVE record

CVSS 8.2 High

YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 26 Oct 2026
CVE-2026-116825 CVE record

CVSS 8.3 High

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
- yeswiki
- Authentication bypass
Not analysed yet 26 Oct 2026
CVE-2026-116824 CVE record

CVSS 5.3 Medium

YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 26 Oct 2026
CVE-2026-116823 CVE record

CVSS 5.3 Medium

YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 26 Oct 2026
CVE-2026-116822 CVE record

CVSS 6.9 Medium

YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
- yeswiki
- Path traversal
Not analysed yet 26 Oct 2026
CVE-2026-116821 CVE record

CVSS 7.1 High

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
- yeswiki
- SQL injection
Not analysed yet 26 Oct 2026
CVE-2026-116820 CVE record

CVSS 6.9 Medium

YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
- yeswiki
- CWE-215
Not analysed yet 26 Oct 2026
CVE-2026-116211 CVE record

CVSS 8.8 High

YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
- yeswiki
- SQL injection
Not analysed yet 25 Oct 2026
CVE-2026-116208 CVE record

CVSS 7.2 High

YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
- yeswiki
- Broken access control
Not analysed yet 25 Oct 2026
CVE-2026-116207 CVE record

CVSS 8.8 High

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
- yeswiki
- SQL injection
Not analysed yet 25 Oct 2026
CVE-2026-116206 CVE record

CVSS 5.3 Medium

YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2026
CVE-2026-116205 CVE record

CVSS 6.9 Medium

YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 25 Oct 2026
CVE-2026-116204 CVE record

CVSS 7.2 High

YesWiki before 4.7.0 CSRF via despam Admin Action
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 25 Oct 2026
CVE-2026-116203 CVE record

CVSS 5.3 Medium

YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2026
CVE-2026-116202 CVE record

CVSS 5.1 Medium

YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 25 Oct 2026
CVE-2026-105224 CVE record

CVSS 5.1 Medium

YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 4 Oct 2026
CVE-2026-104472 CVE record

CVSS 8.7 High

YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
- yeswiki
- Broken access control
Not analysed yet 2 Oct 2026
CVE-2026-104471 CVE record

CVSS 8.6 High

YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
- yeswiki
- Unrestricted file upload
Not analysed yet 2 Oct 2026
CVE-2026-104470 CVE record

CVSS 5.3 Medium

YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104469 CVE record

CVSS 7.6 High

YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
- yeswiki
- Authentication bypass
Not analysed yet 2 Oct 2026
CVE-2026-104468 CVE record

CVSS 6.3 Medium

YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction
- yeswiki
- Authentication bypass
Not analysed yet 2 Oct 2026
CVE-2026-104467 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

YesWiki before 4.6.7 Authorization Bypass via Public API Mode
- yeswiki
- Broken access control
Not analysed yet 2 Oct 2026
CVE-2026-104466 CVE record

CVSS 5.1 Medium

YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 2 Oct 2026
CVE-2026-104465 CVE record

CVSS 5.1 Medium

YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 2 Oct 2026
CVE-2026-104464 CVE record

CVSS 8.8 High

YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104463 CVE record

CVSS 8.3 High

YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104462 CVE record

CVSS 8.8 High

YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
- yeswiki
- SQL injection
Not analysed yet 2 Oct 2026
CVE-2026-104461 CVE record

CVSS 5.1 Medium

YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 2 Oct 2026
CVE-2026-104460 CVE record

CVSS 8.7 High

YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
- yeswiki
- SQL injection
Not analysed yet 2 Oct 2026
CVE-2026-104459 CVE record

CVSS 6.9 Medium

YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104458 CVE record

CVSS 8.3 High

YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104457 CVE record

CVSS 8.8 High

YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
- yeswiki
- SQL injection
Not analysed yet 2 Oct 2026
CVE-2026-104456 CVE record

CVSS 7.2 High

YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
- yeswiki
- SQL injection
Not analysed yet 2 Oct 2026
CVE-2026-104455 CVE record

CVSS 6.9 Medium

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
- yeswiki
- Information disclosure
Not analysed yet 2 Oct 2026
CVE-2026-104454 CVE record

CVSS 6.9 Medium

YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
- yeswiki
- Denial of service
Not analysed yet 2 Oct 2026
CVE-2026-104453 CVE record

CVSS 5.3 Medium

YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104452 CVE record

CVSS 5.3 Medium

YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104451 CVE record

CVSS 5.3 Medium

YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104450 CVE record

CVSS 8.2 High

YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
- yeswiki
- Cross-site scripting (XSS)
Not analysed yet 2 Oct 2026
CVE-2026-104449 CVE record

CVSS 8.3 High

YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
- yeswiki
- Broken access control
Not analysed yet 2 Oct 2026
CVE-2026-104448 CVE record

CVSS 7.2 High

YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104447 CVE record

CVSS 7.1 High

YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction
- yeswiki
- Cross-site request forgery (CSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104446 CVE record

CVSS 6.9 Medium

YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler
- yeswiki
- Authentication bypass
Not analysed yet 2 Oct 2026
CVE-2026-104445 CVE record

CVSS 8.8 High

YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
- yeswiki
- Authentication bypass
Not analysed yet 2 Oct 2026
CVE-2026-104444 CVE record

CVSS 7.1 High

YesWiki before 4.6.7 Authorization Bypass via Comments API editComment
- yeswiki
- Broken access control
Not analysed yet 2 Oct 2026
CVE-2026-104443 CVE record

CVSS 7.2 High

YesWiki before 4.6.7 Scope Bypass via Triples Delete API
- yeswiki
- Broken access control
Not analysed yet 2 Oct 2026
CVE-2026-104442 CVE record

CVSS 6.9 Medium

YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104441 CVE record

CVSS 6.9 Medium

YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104440 CVE record

CVSS 6.9 Medium

YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter
- yeswiki
- Server-side request forgery (SSRF)
Not analysed yet 2 Oct 2026
CVE-2026-104439 CVE record

CVSS 7.1 High

YesWiki before 4.6.7 User Enumeration via Lost-Password Flow
- yeswiki
- CWE-204
Not analysed yet 2 Oct 2026
CVE-2026-104438 CVE record

CVSS 8.7 High

YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions
- yeswiki
- Broken access control
Not analysed yet 2 Oct 2026