CVE-2026-116825highCWE-294

CVE-2026-116825: falha de alta gravidade em yeswiki

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar yeswiki

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.2%
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Produtos afetados
YesWiki · yeswiki
CVEs relacionadas — yeswiki

No mesmo produto, das mais perigosas para as menos.

CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.6%CVE-2026-46670CRITICALYesWiki: Unauthenticated SQL InjectionEPSS 2.0%CVE-2025-46347MEDIUMYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionEPSS 1.0%CVE-2026-52778CRITICALYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)EPSS 0.8%CVE-2026-52762HIGHYesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesEPSS 0.8%CVE-2025-46348CRITICALYesWiki Vulnerable to Unauthenticated Site Backup Creation and DownloadEPSS 0.7%