YesWiki: Unauthenticated SQL Injection

YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)

YesWiki is a wiki system written in PHP

YesWiki is a wiki system written in PHP

YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…

YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

YesWiki is a wiki system written in PHP

YesWiki Authenticated SQL Injection in ReactionManager

YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create

YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing

YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts

YesWiki before 4.7.0 CSRF via despam Admin Action

YesWiki before 4.6.7 Authorization Bypass via Public API Mode

YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler

YesWiki before 4.6.7 Scope Bypass via Triples Delete API

YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username

YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki

YesWiki is a wiki system written in PHP

An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form

YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

YesWiki is a wiki system written in PHP

YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox

YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import

YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile

YesWiki before 4.6.7 Session Fixation via Login in AuthController.php

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames

YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action

YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche

YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read

YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback