Live › vulnerability › CVE-2026-116204
Go to dashboardYesWiki before 4.7.0 has a cross-site request forgery flaw in its despam action, which accepts state-changing requests without a token check. An attacker can plant an auto-submitting form on a wiki page so that an administrator's browser deletes or overwrites pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Any YesWiki installation before 4.7.0 where an administrator is logged in and can view pages that visitors can edit or inject HTML into. Wikis with no raw HTML allowed and no public write access are less exposed. Sites on 4.7.0 or later are not affected.
No product ranges from the sources yet.
4.7.0 are affected.tools/security/actions/despam.php exists and is reachable in the deployment.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.
This page as .md · .json · in your agent: get_signal("CVE-2026-116204")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.