Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-52777
  • github.com/yeswiki/yeswiki
 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize 04 Sep
  • Fix available
  • Severity - 9.4 (Critical)
CVE-2026-52775
  • github.com/yeswiki/yeswiki
 YesWiki Authenticated SQL Injection in ReactionManager 04 Sep
  • Fix available
  • Severity - 8.8 (High)
CVE-2026-52774
  • github.com/yeswiki/yeswiki
 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki 04 Sep
  • Fix available
  • Severity - 6.1 (Medium)
CVE-2026-52773
  • github.com/yeswiki/yeswiki
 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki 04 Sep
  • Fix available
  • Severity - 6.1 (Medium)
CVE-2026-52772
  • github.com/yeswiki/yeswiki
 YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`) 04 Sep
  • Fix available
  • Severity - 5.5 (Medium)
CVE-2026-52771
  • github.com/yeswiki/yeswiki
 YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) 04 Sep
  • Fix available
  • Severity - 8.3 (High)
CVE-2026-52770
  • github.com/yeswiki/yeswiki
 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki 04 Sep
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-52769
  • github.com/yeswiki/yeswiki
 YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` 04 Sep
  • Fix available
  • Severity - 8.3 (High)
CVE-2026-52767
  • github.com/yeswiki/yeswiki
 YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` 04 Sep
  • Fix available
  • Severity - 8.2 (High)
CVE-2026-52766
  • github.com/yeswiki/yeswiki
 YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action 04 Sep
  • Fix available
  • Severity - 9.1 (Critical)
CVE-2026-52763
  • github.com/yeswiki/yeswiki
 YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read 04 Sep
  • Fix available
  • Severity - 6.5 (Medium)
CVE-2026-52762
  • github.com/yeswiki/yeswiki
 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates 04 Sep
  • Fix available
  • Severity - 7.1 (High)
CVE-2026-46670
  • github.com/yeswiki/yeswiki
 YesWiki: Unauthenticated SQL Injection 11 Aug
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-px5m-h76g-p7p8
  • Packagist/yeswiki/yeswiki
 YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service 09 Jul
  • Fix available
  • Severity - 9.8 (Critical)
GHSA-9369-69wj-7m2f
  • Packagist/yeswiki/yeswiki
 YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize 09 Jul
  • Fix available
  • Severity - 9.4 (Critical)
GHSA-4pf7-cc4r-g63h
  • Packagist/yeswiki/yeswiki
 YesWiki has Authenticated SQL Injection via ReactionManager 09 Jul
  • Fix available
  • Severity - 8.8 (High)
Load more...