Skip to contentYeswiki vulnerabilities
Newest
- yeswikiYesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce ParameterCVE-2026-1044406.9 Medium
- yeswikiYesWiki before 4.6.7 User Enumeration via Lost-Password FlowCVE-2026-1044397.1 High
- yeswikiYesWiki before 4.6.7 Information Disclosure via listpagestag and includepages ActionsCVE-2026-1044388.7 High
- yeswikiYesWiki: Authenticated PHP Object Injection in BazarImportAction via unserializeCVE-2026-52777Fix available9.4 Critical
- yeswikiYesWiki Authenticated SQL Injection in ReactionManagerCVE-2026-52775Fix available8.8 High
- yeswikiReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiCVE-2026-52774Public exploitFix available6.1 Medium
- yeswikiReflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWikiCVE-2026-52773Fix available6.1 Medium
- yeswikiYesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)CVE-2026-52772Fix available5.5 Medium
- yeswikiYesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)CVE-2026-52771Fix available8.3 High
- yeswikiImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswikiCVE-2026-52770Fix available7.5 High
- yeswikiYesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`CVE-2026-52769Fix available8.3 High
- yeswikiYesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`CVE-2026-52767Fix available8.2 High
- yeswikiYesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` actionCVE-2026-52766Fix available9.1 Critical
- yeswikiYesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB readCVE-2026-52763Fix available6.5 Medium
- yeswikiYesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesCVE-2026-52762Fix available7.1 High
- yeswikiYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)CVE-2026-52778Fix available9.8 Critical
- yeswikiYesWiki: Unauthenticated SQL InjectionCVE-2026-46670Fix available9.8 Critical
- yeswikiYesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()CVE-2026-41143Fix available8.8 High
- yeswikiYesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpagesCVE-2026-104473Fix available5.1 Medium
- yeswikiYesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"CVE-2026-34598Fix available7.1 High
- yeswikiYesWiki Cross Site Scripting vulnerabilityCVE-2025-522776.1 Medium
- yeswikiYesWiki Vulnerable to Stored XSS in CommentsCVE-2025-46346Fix available6.3 Medium
- yeswikiYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionCVE-2025-46347Fix available5.8 Medium
- yeswikiYesWiki Vulnerable to Unauthenticated Site Backup Creation and DownloadCVE-2025-46348Fix available10.0 Critical
- yeswikiYesWiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingCVE-2025-463497.6 High
- yeswikiYeswiki Vulnerable to Authenticated Reflected Cross-site ScriptingCVE-2025-46350Fix available3.5 Low
- yeswikiYeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingCVE-2025-46550Fix available4.3 Medium
- yeswikiYeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingCVE-2025-46549Fix available4.3 Medium
- yeswikiPath Traversal allowing arbitrary read of files in YeswikiCVE-2025-31131Public exploitFix available8.6 High
- yeswikiYesWiki vulnerable to authenticated arbitrary file deletionCVE-2025-24019Fix available7.1 High
- yeswikiYesWiki Vulnerable to Authenticated Stored XSSCVE-2025-24018Fix available7.6 High
- yeswikiYesWiki Vulnerable to Unauthenticated DOM Based XSSCVE-2025-24017Fix available7.6 High
- yeswikiUse of a Broken or Risky Cryptographic Algorithm in YesWikiCVE-2024-51478Fix available9.9 Critical
- yeswikiSQL Injection in YeswikiCVE-2021-43091Fix available7.5 High
- yeswiki cercopithequeSQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier...CVE-2018-13045Public exploit9.8 Critical
- yeswikiYesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in...CVE-2018-10006419.8 Critical