Vendor
YesWiki
82 known vulnerabilities.
YesWiki at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 54 | 1 |
| Sep 2026 | 12 | 2 |
| Aug 2026 | 1 | 1 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 1 | 1 |
| May 2026 | 1 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 8 | 1 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 3 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
82 results · Feed
-
Medium 4.9
YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the da…
-
Medium 6.8
YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields.…
-
Medium 6.8
YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /a…
-
Medium 6.5
YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can rep…
-
Medium 6.1
YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metachara…
-
Medium 6.1
YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() fa…
-
Medium 5.3
YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values …
-
Medium 5.3
YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain t…
-
Medium 6.5
YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL…
-
High 8.2
YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can i…
-
High 8.1
YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. Attackers can serve a poisoned outbox with cross-actor Dele…
-
Critical 9.1
YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are…
-
Medium 6.4
YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render u…
-
Medium 5.3
YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of …
-
High 8.1
YesWiki before 4.7.0 CSRF via despam Admin Action
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submi…
-
Medium 6.1
YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the …
-
Medium 5.4
YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries…
-
Medium 5.4
YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled s…
-
Medium 6.1
YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauth…
-
High 7.5
YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retri…
-
High 7.2
YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field referenc…
-
Medium 5.0
YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup t…
-
Medium 6.8
YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can r…
-
Medium 4.8
YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser hi…
-
High 8.1
YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_…
-
Medium 5.4
YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown i…
-
Medium 6.1
YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form acti…
-
High 8.6
YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or…
-
High 7.5
YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag ta…
-
High 7.0
YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId …
-
Medium 5.4
YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+…
-
Medium 6.5
YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abon…
-
High 7.5
YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malici…
-
Medium 6.5
YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId t…
-
High 8.6
YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs ca…
-
High 7.6
YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote …
-
Medium 5.3
YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin…
-
Medium 5.3
YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 5…
-
Medium 5.4
YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter vi…
-
Medium 5.4
YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-lev…