YesWiki versions prior to 4.6.7 have a cross-site request forgery (CSRF) vulnerability in the RevisionsHandler component. This flaw allows attackers to trick authorized users into restoring old page revisions via specially crafted GET requests that do not require a CSRF token. Exploitation can result in silent overwriting of current page content with outdated or vandalized revisions without user awareness.
YesWiki versions prior to 4.6.7 have a cross-site request forgery (CSRF) vulnerability in the admintag action. This flaw allows attackers to trick administrators into clicking crafted GET links that delete tag associations. The vulnerability exploits the SameSite=Lax cookie behavior to perform bulk deletion of tag triples via the delete_tag parameter.
YesWiki versions prior to 4.6.7 have an access control bypass vulnerability that permits unauthenticated attackers to read restricted page content. This occurs via the recentchangesrssplus RSS action, which allows retrieval of 500-character excerpts from the latest pages, including those that are read-restricted such as drafts and notes. The vulnerability has a medium severity rating with a CVSS score of 5.3.
YesWiki versions prior to 4.6.7 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to make the server fetch arbitrary hosts and ports by exploiting the url parameter in the {{valeur}} action. Attackers can submit this action through the content parameter of handlers/page/render.php to probe internal HTTP services and read response content that matches fiche markup. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity.
YesWiki versions before 4.6.7 have a blind server-side request forgery (SSRF) vulnerability in the /api/entries/bazarlist endpoint. This flaw allows unauthenticated attackers to make arbitrary server-side requests by exploiting the idtypeannonce parameter. The vulnerability arises because the isValidURL() function always returns true, enabling attackers to supply internal URLs that the server fetches using curl in loadURLContent(). This can be used to probe internal networks and access internal services or metadata endpoints.
YesWiki versions prior to 4.6.7 have an authentication bypass vulnerability in the contact mail AJAX handler. This flaw allows unauthenticated attackers to send emails through the wiki's SMTP server by crafting POST XMLHttpRequests without required parameters. The vulnerability can be exploited to send arbitrary emails, potentially facilitating spam or phishing attacks.
YesWiki versions prior to 4.6.7 have a missing authorization vulnerability in the tags tool's listpagestag and includepages actions. This flaw allows unauthenticated or unprivileged attackers to enumerate page names and titles of pages protected by access control lists (ACLs) without proper read permission checks. The vulnerability can lead to unauthorized disclosure of page metadata but does not impact page content integrity or availability.
YesWiki versions before 4.6.7 have a cross-site request forgery (CSRF) vulnerability in the autoupdate UpdateAction. This flaw allows attackers to delete installed packages by tricking a logged-in administrator into clicking a crafted link. The vulnerability can be exploited via unprotected GET requests with specific parameters, potentially removing critical extensions like bazar and disrupting core site functionality.
YesWiki versions before 4.6.7 have an authorization bypass vulnerability in the comments API editComment route. This flaw allows authenticated users with low privileges to overwrite arbitrary pages or comments by manipulating the pagetag field in a POST request. The vulnerability bypasses per-page write access controls, enabling unauthorized content replacement and reparenting of pages or comments.
YesWiki versions prior to 4.6.7 have a vulnerability in the triples delete API where an empty-filter scope bypass allows any authenticated user to delete or forge arbitrary semantic triples. This includes the ability to remove the admins-group membership triple, which can cause a site-wide authorization lockout by emptying the admin group.
YesWiki versions prior to 4.6.7 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to supply a syndication action via the render handler's content parameter, causing the server to fetch arbitrary URLs. Exploitation can target internal hosts and ports, read fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
YesWiki versions prior to 4.6.7 have an authentication bypass vulnerability in the ActivityPub inbox. This flaw allows unauthenticated attackers with any ActivityPub keypair to send signed Delete or Update activities that can delete or overwrite federated entries of other actors. The vulnerability arises because the system fails to bind the verified HTTP signature signer to the activity actor, enabling unauthorized modification of federated content.
YesWiki versions prior to 4.6.7 have a user enumeration vulnerability in the LostPasswordAction.php component. This flaw allows unauthenticated attackers to confirm whether an email address is registered by observing different responses from the password recovery page. There is no rate limiting on submissions, enabling attackers to automate identification of valid accounts. This can facilitate targeted phishing or password spraying attacks.
A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient length validation of the `account_name` parameter when processing account management requests. An attacker authenticated as a read-only user to the web management interface could supply a specially crafted account name that exceeds the size of the internal stack buffer, resulting in corruption of program execution flow. Successful exploitation could allow an attacker to read sensitive information from device memory, including credentials, modify arbitrary memory contents, and disrupt device availability.
CVE-2026-80298 is a high-severity SQL injection vulnerability in HAVELSAN Inc.'s Sef - AI Chatbot Platform versions before 2.1. The flaw involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges and no user interaction to potentially execute arbitrary SQL commands. This can lead to full confidentiality, integrity, and availability compromise of the affected system.
CVE-2026-94405 is an authorization bypass vulnerability in Shahjada Download Manager that allows an attacker to retrieve embedded sensitive data by manipulating a user-controlled key. The vulnerability affects versions up to 3.3.71. It has a medium severity with a CVSS score of 5.3, indicating a network attack vector with low complexity and no privileges or user interaction required. The impact is limited to confidentiality loss without integrity or availability impact. No patch or remediation information is currently available.
A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application affecting the 'nomTamano' parameter at the '/es/companysizemployees/update' endpoint. This vulnerability could allow an attacker to execute arbitrary code in a victim's browser by tricking the user. No affected versions or patches are specified. The vulnerability is rated medium severity.
A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application affecting the 'nomOrigen' parameter at the '/es/origins/store' endpoint. This vulnerability allows an attacker to execute arbitrary code in a victim's browser by tricking the user. The vulnerability is classified as medium severity. No affected versions or patch information are provided. There are no known exploits in the wild.
A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application affecting the 'nomTamano' parameter at the '/es/companysizebills/store' endpoint. This vulnerability could allow an attacker to execute arbitrary code in a victim's browser by tricking the user. No affected versions or patch information are provided. The vulnerability is rated medium severity based on the described impact.
A Cross-Site Scripting (XSS) vulnerability exists in the Repasat application in the 'nomGrupoEmpresarial' parameter at the endpoint '/es/corporategroups/update/246'. This vulnerability could allow attackers to execute arbitrary code in a victim's browser by tricking the user. No affected versions or patches are specified. The vulnerability is rated medium severity.