These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-105224 is a cross-site scripting vulnerability in YesWiki before 4.6.7. The Bazar valeur action allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. To address this, prioritize updating to version 4.6.7 or later and review page editor permissions. Ensure that page editors understand the risks of injecting script and take steps to mitigate them. Additionally, [truncated]
CVE-2026-104470 is a server-side request forgery vulnerability in YesWiki before version 4.6.7. The vulnerability allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can exploit this by embedding the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.
CVE-2026-104473 is a reflected cross-site scripting vulnerability in YesWiki before version 4.5.3. The vulnerability allows remote attackers to inject JavaScript through unsanitized parameters, potentially leading to session hijacking and authenticated requests against backend functionality. This type of vulnerability is particularly concerning for systems with unauthenticated or public-facing access, as [truncated]
A critical vulnerability exists in YesWiki, a wiki system written in PHP, prior to version 4.6.4. An unauthenticated SQL injection in the Bazar form-import path allows arbitrary SQL injection into an INSERT statement, enabling any unauthenticated visitor to read the full database, including yeswiki_users.password hashes. This vulnerability has significant implications for the security of YesWiki installat [truncated]
A critical vulnerability (CVSS Score: 9.8) exists in YesWiki's Bazar form field calculator (CalcField.php) prior to version 4.6.6. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. However, this implementation is flawed, making it vulnerable to Regular Expression Denial of Service (ReDoS / St [truncated]