YE
Product
yeswiki
85
CVEs
0
On KEV
9.8
Max CVSS
54
New 30D
Severity mix
Critical 9High 27Medium 49Low 0
Watch
Add yeswiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116203 New | 6.1 | Oct 25 | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters Affected: before 4.7.0 |
| CVE-2026-104473 | 6.1 | Oct 2 | YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages Affected: before 4.5.3 |
| CVE-2026-104465 | 6.1 | Oct 2 | YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler Affected: before 4.6.7 |
| CVE-2026-52774 | 6.1 | Sep 4 | Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki Affected: < 4.6.6 |
| CVE-2026-52773 | 6.1 | Sep 4 | Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki Affected: >= 4.1.0, < 4.6.6 |
| CVE-2026-34598 | 6.1 | Apr 2 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" Affected: < 4.6.0 |
| CVE-2025-52277 | 6.1 | Sep 9 | Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field Affected: 4.5.4 |
| CVE-2025-46550 | 6.1 | Apr 29 | YesWiki is a wiki system written in PHP Affected: before 4.5.4 |
| CVE-2025-46549 | 6.1 | Apr 29 | YesWiki is a wiki system written in PHP Affected: before 4.5.4 |
| CVE-2025-46349 | 6.1 | Apr 29 | YesWiki is a wiki system written in PHP Affected: before 4.5.4 |
| CVE-2025-24017 | 6.1 | Jan 21 | YesWiki is a wiki system written in PHP Affected: before 4.5.0 |
| CVE-2026-104442 | 5.8 | Oct 2 | YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action Affected: before 4.6.7 |
| CVE-2026-52772 | 5.5 | Sep 4 | YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`) Affected: < 4.6.6 |
| CVE-2026-116202 New | 5.4 | Oct 25 | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload Affected: before 4.7.0 |
| CVE-2026-105224 | 5.4 | Oct 4 | YesWiki before 4.6.7 Stored XSS via Bazar valeur Action Affected: before 4.6.7 |
| CVE-2026-104466 | 5.4 | Oct 2 | YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute Affected: before 4.6.7 |
| CVE-2026-104461 | 5.4 | Oct 2 | YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField Affected: before 4.6.7 |
| CVE-2026-104453 | 5.4 | Oct 2 | YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action Affected: before 4.6.7 |
| CVE-2026-104452 | 5.4 | Oct 2 | YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler Affected: before 4.6.7 |
| CVE-2025-46346 | 5.4 | Apr 29 | YesWiki is a wiki system written in PHP Affected: before 4.5.4 |
| CVE-2025-24018 | 5.4 | Jan 21 | YesWiki is a wiki system written in PHP Affected: before 4.5.0 |
| CVE-2026-116822 New | 5.3 | Oct 26 | YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter Affected: before 4.7.0 |
| CVE-2026-116820 New | 5.3 | Oct 26 | YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter Affected: 4.6.0 before 4.7.0 |
| CVE-2026-116205 New | 5.3 | Oct 25 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax Affected: before 4.7.0 |
| CVE-2026-104455 | 5.3 | Oct 2 | YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action Affected: before 4.6.7 |
| CVE-2026-104454 | 5.3 | Oct 2 | YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint Affected: before 4.6.7 |
| CVE-2026-104441 | 5.3 | Oct 2 | YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action Affected: before 4.6.7 |
| CVE-2026-104440 | 5.3 | Oct 2 | YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter Affected: before 4.6.7 |
| CVE-2026-104439 | 5.3 | Oct 2 | YesWiki before 4.6.7 User Enumeration via Lost-Password Flow Affected: before 4.6.7 |
| CVE-2026-104438 | 5.3 | Oct 2 | YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions Affected: before 4.6.7 |
| CVE-2026-104470 | 5.0 | Oct 2 | YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter Affected: before 4.6.7 |
| CVE-2026-116828 New | 4.9 | Oct 26 | YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand Affected: before 4.7.0 |
| CVE-2026-104468 | 4.8 | Oct 2 | YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction Affected: before 4.6.7 |
| CVE-2025-46350 | 4.8 | Apr 29 | YesWiki is a wiki system written in PHP Affected: before 4.5.4 |
| CVE-2026-104451 | 4.3 | Oct 2 | YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler Affected: before 4.6.7 |