PT-2026-104249 · Yeswiki · Yeswiki
CVSS v4.0
7.1
عالية
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
YesWiki versions prior to 4.6.7
Description
An issue in
LostPasswordAction.php allows unauthenticated attackers to confirm registered email addresses by analyzing differing server responses. This occurs on the MotDePassePerdu recovery page, which lacks rate limiting, enabling attackers to identify valid accounts for targeted phishing or password-spraying attacks.Recommendations
Update YesWiki to version 4.6.7 or later.
استغلال
إصلاح
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Yeswiki