CVE-2026-104448

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104448

YesWiki versions prior to 4.6.7 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the ajaxdeletepage handler. The root cause is the application's failure to validate a CSRF token on GET requests that include a jsonp_callback parameter. An attacker could entice a logged-in...

CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...

EUVD-2026-91459

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted lin...