Vulnerabilidades en YesWiki
65 resultadosCVE-2026-104454MEDIUMYesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview EndpointEPSS 0.4%CVE-2026-104445HIGHYesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor SpoofingEPSS 0.4%CVE-2026-104459MEDIUMYesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handleEPSS 0.4%CVE-2026-104460HIGHYesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearchEPSS 0.4%CVE-2026-52763MEDIUMYesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB readEPSS 0.4%CVE-2024-51478CRITICALUse of a Broken or Risky Cryptographic Algorithm in YesWikiEPSS 0.4%CVE-2026-104471HIGHYesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV ImportEPSS 0.4%CVE-2026-104467CRITICALYesWiki before 4.6.7 Authorization Bypass via Public API ModeEPSS 0.4%CVE-2026-104455MEDIUMYesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS ActionEPSS 0.4%CVE-2026-104443HIGHYesWiki before 4.6.7 Scope Bypass via Triples Delete APIEPSS 0.4%CVE-2026-52767HIGHYesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`EPSS 0.4%CVE-2025-46346MEDIUMYesWiki Vulnerable to Stored XSS in CommentsEPSS 0.4%CVE-2025-24017HIGHYesWiki Vulnerable to Unauthenticated DOM Based XSSEPSS 0.4%CVE-2026-104472HIGHYesWiki before 4.6.7 Missing Authorization via Attachment Download HandlerEPSS 0.3%CVE-2026-52772MEDIUMYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)EPSS 0.3%CVE-2026-104439HIGHYesWiki before 4.6.7 User Enumeration via Lost-Password FlowEPSS 0.3%CVE-2026-104442MEDIUMYesWiki before 4.6.7 Unauthenticated SSRF via syndication ActionEPSS 0.3%CVE-2026-104458HIGHYesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition AddressesEPSS 0.3%CVE-2026-34598HIGHYesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"EPSS 0.3%CVE-2026-104462HIGHYesWiki before 4.6.7 SQL Injection via nuagetag tags parameterEPSS 0.3%