8 matches found
EUVD-2026-91478
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...
CVE-2026-104467
Versions of YesWiki prior to 4.6.7 are susceptible to an authorization bypass vulnerability within the ApiService::isAuthorized() function. When public API mode is enabled, unauthenticated attackers can access administrative-only API routes. Specifically, attackers can target endpoints such as ap...
PT-2026-104277
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update config and api/archives to overwrite...
Cross-site Scripting (XSS)
Overview yourls/yourls is an is a set of PHP scripts that allow you to run Your Own URL Shortener. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the callback and jsonp request parameters, which are concatenated into the response without proper sanitization. An...
PT-2025-62941
Summary The callback and jsonp request parameters are directly concatenated into the response without any sanitization that allowing attackers to inject arbitrary JS code. When YOURLS PRIVATE is set to false public API mode, this vulnerability can be exploited by any unauthenticated attacker. In...