CVE-2026-116825Medium· 6.5▾ SunlitYesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions.
yeswiki >= 4.6.2 < 4.7.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116822Medium· 5.3YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
CVE-2026-116826Medium· 6.8YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
CVE-2026-116820Medium· 5.3YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
CVE-2026-116824Medium· 6.1YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
CVE-2026-116827Medium· 6.8YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
CVE-2026-116823Medium· 6.1YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback