{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "yeswiki: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/yeswiki--yeswiki/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/yeswiki--yeswiki/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116211/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116211/",
   "title": "CVE-2026-116211 disclosed",
   "content_text": "YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.",
   "date_published": "2026-10-25T13:20:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116208/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116208/",
   "title": "CVE-2026-116208 disclosed",
   "content_text": "YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Delete, Update, or Create activities during admin-initiated sync to delete, overwrite, forge, or mass-delete entries.",
   "date_published": "2026-10-25T13:20:38Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116207/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116207/",
   "title": "CVE-2026-116207 disclosed",
   "content_text": "YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().",
   "date_published": "2026-10-25T13:20:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-116204/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-116204/",
   "title": "CVE-2026-116204 disclosed",
   "content_text": "YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.",
   "date_published": "2026-10-25T13:20:35Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104472/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104472/",
   "title": "CVE-2026-104472 disclosed",
   "content_text": "YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages.",
   "date_published": "2026-10-02T11:38:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104471/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104471/",
   "title": "CVE-2026-104471 disclosed",
   "content_text": "YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.",
   "date_published": "2026-10-02T11:38:36Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104467/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104467/",
   "title": "CVE-2026-104467 disclosed",
   "content_text": "YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.",
   "date_published": "2026-10-02T11:38:33Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104464/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104464/",
   "title": "CVE-2026-104464 disclosed",
   "content_text": "YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.",
   "date_published": "2026-10-02T11:38:31Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104463/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104463/",
   "title": "CVE-2026-104463 disclosed",
   "content_text": "YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.",
   "date_published": "2026-10-02T11:38:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104462/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104462/",
   "title": "CVE-2026-104462 disclosed",
   "content_text": "YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.",
   "date_published": "2026-10-02T11:38:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104460/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104460/",
   "title": "CVE-2026-104460 disclosed",
   "content_text": "YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.",
   "date_published": "2026-10-02T11:38:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104457/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104457/",
   "title": "CVE-2026-104457 disclosed",
   "content_text": "YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.",
   "date_published": "2026-10-02T11:38:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104456/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104456/",
   "title": "CVE-2026-104456 disclosed",
   "content_text": "YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.",
   "date_published": "2026-10-02T11:38:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104448/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104448/",
   "title": "CVE-2026-104448 disclosed",
   "content_text": "YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.",
   "date_published": "2026-10-02T11:38:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104447/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104447/",
   "title": "CVE-2026-104447 disclosed",
   "content_text": "YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.",
   "date_published": "2026-10-02T11:38:20Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104445/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104445/",
   "title": "CVE-2026-104445 disclosed",
   "content_text": "YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.",
   "date_published": "2026-10-02T11:38:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104444/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104444/",
   "title": "CVE-2026-104444 disclosed",
   "content_text": "YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.",
   "date_published": "2026-10-02T11:38:18Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104443/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104443/",
   "title": "CVE-2026-104443 disclosed",
   "content_text": "YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.",
   "date_published": "2026-10-02T11:38:17Z"
  }
 ]
}