YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
CVE-2026-104458
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthentica
#advisory
共收录 23210 条相关情报。
← 返回所有主题YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filte
YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
CVE-2026-104456
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a st
YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
CVE-2026-104455
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restr
YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) ma
YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
CVE-2026-104453
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to
YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler
CVE-2026-104452
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes
YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler
CVE-2026-104451
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to re
YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
CVE-2026-104450
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php
YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
CVE-2026-104449
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existi
YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
CVE-2026-104448
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanentl
YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction
CVE-2026-104447
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows atta
YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler
CVE-2026-104446
YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated atta
YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the ver
YesWiki before 4.6.7 Authorization Bypass via Comments API editComment
CVE-2026-104444
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows au
YesWiki before 4.6.7 Scope Bypass via Triples Delete API
CVE-2026-104443
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user
YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action
CVE-2026-104442
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers
YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action
CVE-2026-104441
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers
YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter
CVE-2026-104440
YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to
YesWiki before 4.6.7 User Enumeration via Lost-Password Flow
CVE-2026-104439
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated att