CVE-2026-104467

Versions of YesWiki prior to 4.6.7 are susceptible to an authorization bypass vulnerability within the ApiService::isAuthorized() function. When public API mode is enabled, unauthenticated attackers can access administrative-only API routes. Specifically, attackers can target endpoints such as ap...

EUVD-2026-91478

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

Cross-site Scripting (XSS)

Overview yourls/yourls is an is a set of PHP scripts that allow you to run Your Own URL Shortener. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the callback and jsonp request parameters, which are concatenated into the response without proper sanitization. An...