Read the docs

Requarks

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Requarks records in CISA KEV

No Requarks vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wiki.js 14 records HIGH

Records

19 records

TI-2026-62518 CVE-2026-92776 · GHSA-mxgr-89mh-cjg6

Wiki.js through 2.5.314 Path Prefix Matching Authorization Bypass

Priority HIGH 72

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00448 Published 2026-09-16 No fix listed CWE-863
TI-2026-62517 CVE-2026-92775 · GHSA-7mqp-q79v-g27v

Wiki.js through 2.5.314 Server-Side Request Forgery via Image Prefetch

Priority MEDIUM 64

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-16 No fix listed CWE-918
TI-2021-07999 CVE-2021-25993 · GHSA-42pj-96jc-q58w

Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor

Priority MEDIUM 58

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in th…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00639 Published 2021-12-29 No fix listed CWE-79
TI-2026-62516 CVE-2026-92774 · GHSA-69p6-97m5-6vpp

Wiki.js through 2.5.314 Authorization Bypass via GraphQL Tag Omission

Priority MEDIUM 57

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to be bypassed.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00367 Published 2026-09-16 No fix listed CWE-863
TI-2020-12008 CVE-2020-15236

Directory Traversal in Wiki.js

Priority MEDIUM 41

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01766 Published 2020-10-05 Fixed in 2.5.151 CWE-22
TI-2021-19661 CVE-2021-43855

Stored XSS via SVG in Requarks/wiki

Priority LOW 37

Wiki.js is a wiki app built on node.js.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00916 Published 2021-12-27 Fixed in 2.5.264 CWE-79
TI-2021-04482 CVE-2021-21383

XSS in Wiki.js

Priority LOW 35

Wiki.js an open-source wiki app built on Node.js.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00971 Published 2021-03-18 Fixed in 2.5.191 CWE-79
TI-2020-08925 CVE-2020-11051

XSS in Wiki.js

Priority LOW 31

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0061 Published 2020-05-05 Fixed in 2.3.81 CWE-79
TI-2020-03541 CVE-2020-4052

Stored XSS through template injection in Wiki.js

Priority LOW 30

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00856 Published 2020-06-16 Fixed in 2.4.107 CWE-79
TI-2020-12044 CVE-2020-15274

Stored XSS via search result in Wiki.js

Priority LOW 27

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results.

CVSS 3.1MEDIUM 5.8 Network Low privileges User interaction EPSS 0.00765 Published 2020-10-26 Fixed in 2.5.162 CWE-79
Open these records in search →