requarks

7 results · Clear filters · Feed

• Medium 6.5
  CVE-2026-92775

  Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch

  Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the pre…

  requarks Wiki.js
  Sep 16, 2026
• Medium 4.3
  CVE-2026-92774

  Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

  Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed. Attackers can query the list, tree, tags, searchTags, and links resolvers to retrieve restricted page metad…

  requarks Wiki.js
  Sep 16, 2026
• Medium 4.3
  CVE-2024-45298

  Disabled user can bypass lockout by requesting password reset in wiki.js

  Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function. While setting up SMTP e-mail's on my server, I tested said e-mails by performing a password reset with my test user. T…

  requarks wiki
  Sep 18, 2024
• Medium 5.4
  CVE-2021-25993

  Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor

  In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens t…

  requarks wiki
  Dec 29, 2021
• Medium 5.4
  CVE-2021-43842

  Stored XSS via SVG file upload in Wiki.js

  Wiki.js is a wiki app built on Node.js. Wiki.js versions 2.5.257 and earlier are vulnerable to stored cross-site scripting through a SVG file upload. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This…

  requarks wiki
  Dec 20, 2021
• Medium 5.8
  CVE-2020-15274

  Stored XSS via search result in Wiki.js

  In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit…

  requarks Wiki.js
  Oct 26, 2020
• Medium 6.9
  CVE-2020-11051

  XSS in Wiki.js

  In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the M…

  requarks Wiki.js
  May 5, 2020