Archive
2 October 2026
Vulnerabilities first published on this day (UTC), newest first.
405 results · Feed
-
High 8.2
Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up
Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.…
-
Medium 6.3
Apache Thrift: C++ WebSocket server transport does not read a full request length
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
High 7.3
onetwothreeneth HospitalManagementSystem edit_accounts.php get sql injection
A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. This affects the function get of the file edit_accounts.php. This manipulation of the argument user_id/patient_id/physician_id/discounts…
-
High 8.2
Apache Thrift: An exception escaping a libevent callback stops the D library's non-blocking server, allowing an unauthenticated remote attacker to deny service
Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to ver…
-
High 8.7
Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec
NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
-
High 8.7
Apache Thrift: A truncated HTTP request stops the D library's server, allowing an unauthenticated remote attacker to deny service
Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version…
-
Medium 6.3
Apache Thrift, Apache Thrift, Apache Thrift: A map key from the wire can replace a decoded object's prototype in generated JavaScript
Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0 and re-generate JS co…
-
Medium 6.1
YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauth…
-
High 7.5
YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retri…
-
High 7.2
YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field referenc…
-
Medium 5.0
YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup t…
-
Medium 6.8
YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can r…
-
Medium 4.8
YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser hi…
-
High 8.1
YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_…
-
Medium 5.4
YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown i…
-
Medium 6.1
YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form acti…
-
High 8.6
YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or…
-
High 7.5
YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag ta…
-
High 7.0
YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId …
-
Medium 5.4
YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+…
-
Medium 6.5
YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abon…
-
High 7.5
YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malici…
-
Medium 6.5
YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId t…
-
High 8.6
YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs ca…
-
High 7.6
YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote …
-
Medium 5.3
YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin…
-
Medium 5.3
YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 5…
-
Medium 5.4
YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter vi…
-
Medium 5.4
YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-lev…
-
Medium 4.3
YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level naviga…
-
Medium 6.5
YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and de…
-
High 8.1
YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in admin…
-
Medium 6.5
YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry wi…
-
High 7.1
YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action…
-
Medium 6.5
YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler
YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type paramete…
-
High 8.2
YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update …
-
High 7.1
YesWiki before 4.6.7 Authorization Bypass via Comments API editComment
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can se…
-
High 8.1
YesWiki before 4.6.7 Scope Bypass via Triples Delete API
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to…
-
Medium 5.8
YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can tar…
-
Medium 5.3
YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the c…