Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the wakka.php process. An attacker can cause resource exhaustion and disrupt service availability by submitting a specially crafted body containing bracket characters to the edit-preview...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the wakka.php process. An attacker can execute arbitrary JavaScript code in the context of users' browsers by injecting crafted markdown image URLs containing malicious event handlers. Details Cross-site...

CVE-2026-104466

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104454

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

EUVD-2026-91477

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466

YesWiki versions prior to 4.6.7 are susceptible to a stored cross-site scripting (XSS) vulnerability located in the formatters/wakka.php component. The root cause is the improper handling of quotes in markdown image URLs , which allows users with page editing or comment posting privileges to inje...

EUVD-2026-91465

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454

YesWiki versions before 4.6.7 are vulnerable to an algorithmic-complexity denial of service within the wakka.php formatter. The root cause is an O(n^2) markdown-link regular expression that allows unauthenticated attackers to submit a small, specially crafted body of bracket characters to the pag...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

PT-2026-104276

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

PT-2026-104264

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104454: Inefficient Regular Expression Complexity

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an On^2 markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool...

CVE-2026-104466: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...