YE
Product
yeswiki
85
CVEs
0
On KEV
9.8
Max CVSS
54
New 30D
Severity mix
Critical 9High 27Medium 49Low 0
Watch
Add yeswiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-52775 | 8.8 | Sep 4 | YesWiki Authenticated SQL Injection in ReactionManager Affected: < 4.6.6 |
| CVE-2026-41143 | 8.8 | May 7 | YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave() Affected: < 4.6.1 |
| CVE-2026-104464 | 8.6 | Oct 2 | YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter Affected: before 4.6.7 |
| CVE-2026-104457 | 8.6 | Oct 2 | YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter Affected: before 4.6.7 |
| CVE-2026-52771 | 8.3 | Sep 4 | YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`) Affected: >= 4.2.0, < 4.6.6 |
| CVE-2026-52769 | 8.3 | Sep 4 | YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` Affected: >= 4.6.2, < 4.6.6 |
| CVE-2026-116211 New | 8.2 | Oct 25 | YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create Affected: 4.5.0 before 4.7.0 |
| CVE-2026-104445 | 8.2 | Oct 2 | YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing Affected: before 4.6.7 |
| CVE-2026-52767 | 8.2 | Sep 4 | YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` Affected: >= 4.6.2, < 4.6.6 |
| CVE-2026-116208 New | 8.1 | Oct 25 | YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts Affected: 4.6.2 before 4.7.0 |
| CVE-2026-116204 New | 8.1 | Oct 25 | YesWiki before 4.7.0 CSRF via despam Admin Action Affected: before 4.7.0 |
| CVE-2026-104467 | 8.1 | Oct 2 | YesWiki before 4.6.7 Authorization Bypass via Public API Mode Affected: before 4.6.7 |
| CVE-2026-104448 | 8.1 | Oct 2 | YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler Affected: before 4.6.7 |
| CVE-2026-104443 | 8.1 | Oct 2 | YesWiki before 4.6.7 Scope Bypass via Triples Delete API Affected: before 4.6.7 |
| CVE-2026-104456 | 7.6 | Oct 2 | YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username Affected: before 4.6.7 |
| CVE-2026-104472 | 7.5 | Oct 2 | YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler Affected: before 4.6.7 |
| CVE-2026-104462 | 7.5 | Oct 2 | YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter Affected: before 4.6.7 |
| CVE-2026-104460 | 7.5 | Oct 2 | YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch Affected: before 4.6.7 |
| CVE-2026-52770 | 7.5 | Sep 4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki Affected: < 4.6.6 |
| CVE-2025-31131 | 7.5 | Apr 1 | YesWiki is a wiki system written in PHP Affected: before 4.5.2 |
| CVE-2021-43091 | 7.5 | Mar 25 | An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form Affected: 4.1.0 |
| CVE-2026-104471 | 7.2 | Oct 2 | YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import Affected: before 4.6.7 |
| CVE-2026-104447 | 7.1 | Oct 2 | YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction Affected: before 4.6.7 |
| CVE-2026-104444 | 7.1 | Oct 2 | YesWiki before 4.6.7 Authorization Bypass via Comments API editComment Affected: before 4.6.7 |
| CVE-2026-52762 | 7.1 | Sep 4 | YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates Affected: < 4.6.6 |
| CVE-2025-24019 | 7.1 | Jan 21 | YesWiki is a wiki system written in PHP Affected: before 4.5.0 |
| CVE-2026-104463 | 7.0 | Oct 2 | YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox Affected: before 4.6.7 |
Showing 27