Yeswiki - vulnerabilities (CVEs)

86 CVEs in 2 products, 54 in the last 30 days, newest from 2026-10-26.

Products

Yeswiki - 70 CVEs
Cercopitheque - 1 CVEs

Newest CVEs of Yeswiki

CVE-2026-116828 - CVSS 6.9 (medium), 2026-10-26: YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position.…
CVE-2026-116826 - CVSS 8.2 (high), 2026-10-26: YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to…
CVE-2026-116827 - CVSS 8.2 (high), 2026-10-26: YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated…
CVE-2026-116825 - CVSS 8.3 (high), 2026-10-26: YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen…
CVE-2026-116824 - CVSS 6.1 (medium), 2026-10-26: YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject…
CVE-2026-116823 - CVSS 6.1 (medium), 2026-10-26: YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query…
CVE-2026-116822 - CVSS 6.9 (medium), 2026-10-26: YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within…
CVE-2026-116821 - CVSS 7.1 (high), 2026-10-26: YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the…
CVE-2026-116820 - CVSS 6.9 (medium), 2026-10-26: YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding…
CVE-2026-116211 - CVSS 8.8 (high), 2026-10-25: YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is…
CVE-2026-116208 - CVSS 8.1 (high), 2026-10-25: YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers…
CVE-2026-116207 - CVSS 9.1 (critical), 2026-10-25: YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in…
CVE-2026-116206 - CVSS 6.4 (medium), 2026-10-25: YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies…
CVE-2026-116205 - CVSS 6.9 (medium), 2026-10-25: YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying…
CVE-2026-116204 - CVSS 8.1 (high), 2026-10-25: YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated…
CVE-2026-116203 - CVSS 6.1 (medium), 2026-10-25: YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without…
CVE-2026-116202 - CVSS 5.4 (medium), 2026-10-25: YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files…
CVE-2026-105224 - CVSS 5.4 (medium), 2026-10-04: YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped…
CVE-2026-104473 - CVSS 6.1 (medium), 2026-10-02: YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized…
CVE-2026-104472 - CVSS 8.7 (high), 2026-10-02: YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page…
CVE-2026-104471 - CVSS 8.6 (high), 2026-10-02: YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/…
CVE-2026-104470 - CVSS 5.3 (medium), 2026-10-02: YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url…
CVE-2026-104469 - CVSS 7.6 (high), 2026-10-02: YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the…
CVE-2026-104468 - CVSS 6.3 (medium), 2026-10-02: YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack…
CVE-2026-104467 - CVSS 9.2 (critical), 2026-10-02: YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API…
CVE-2026-104466 - CVSS 5.4 (medium), 2026-10-02: YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to…
CVE-2026-104465 - CVSS 6.1 (medium), 2026-10-02: YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter…
CVE-2026-104464 - CVSS 8.8 (high), 2026-10-02: YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying…
CVE-2026-104463 - CVSS 8.3 (high), 2026-10-02: YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed…
CVE-2026-104462 - CVSS 8.8 (high), 2026-10-02: YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN…