CVE-2026-104439

5.3 MEDIUMpublic exploit available

Published 2026-10-02 · Updated 2026-10-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-204

Public exploit & PoC references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-892r-45m6-45xc
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-892r-45m6-45xc

All references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-892r-45m6-45xc
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-user-enumeration-via-lost-password-flow
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-892r-45m6-45xc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2026-102587
LOWCVE-2026-103526
MEDIUMCVE-2026-105664PoC
MEDIUMCVE-2026-107843PoC
MEDIUMCVE-2026-109206PoC
MEDIUMCVE-2026-110310PoC
CRITICALCVE-2026-111235PoC
MEDIUMCVE-2026-111386PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.