YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import

YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile

YesWiki before 4.6.7 Session Fixation via Login in AuthController.php

YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox

YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames

YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses

YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action

YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche

YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler

YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read

YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback

YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters

YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler

Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"

Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field

YesWiki is a wiki system written in PHP

YesWiki is a wiki system written in PHP

YesWiki is a wiki system written in PHP

YesWiki is a wiki system written in PHP

YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action

YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)

YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload

YesWiki before 4.6.7 Stored XSS via Bazar valeur Action

YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action

YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler

YesWiki is a wiki system written in PHP

YesWiki is a wiki system written in PHP

YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter

YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter

YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action

YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action

YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter

YesWiki before 4.6.7 User Enumeration via Lost-Password Flow

YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter

YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand

YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction

YesWiki is a wiki system written in PHP

YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler