Read the docs

Requarks

Records19All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high11CVSS 7.0–8.9

Exploited now

Requarks records in CISA KEV

No Requarks vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wiki.js 14 records HIGH

Records

14 records in Wiki.js · all components

TI-2021-07999 CVE-2021-25993 · GHSA-42pj-96jc-q58w

Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor

Priority MEDIUM 58

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in th…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00639 Published 2021-12-29 No fix listed CWE-79
TI-2020-12008 CVE-2020-15236

Directory Traversal in Wiki.js

Priority MEDIUM 41

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01766 Published 2020-10-05 Fixed in 2.5.151 CWE-22
TI-2021-19661 CVE-2021-43855

Stored XSS via SVG in Requarks/wiki

Priority LOW 37

Wiki.js is a wiki app built on node.js.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00916 Published 2021-12-27 Fixed in 2.5.264 CWE-79
TI-2021-04482 CVE-2021-21383

XSS in Wiki.js

Priority LOW 35

Wiki.js an open-source wiki app built on Node.js.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00971 Published 2021-03-18 Fixed in 2.5.191 CWE-79
TI-2020-08925 CVE-2020-11051

XSS in Wiki.js

Priority LOW 31

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0061 Published 2020-05-05 Fixed in 2.3.81 CWE-79
TI-2020-03541 CVE-2020-4052

Stored XSS through template injection in Wiki.js

Priority LOW 30

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00856 Published 2020-06-16 Fixed in 2.4.107 CWE-79
TI-2020-12044 CVE-2020-15274

Stored XSS via search result in Wiki.js

Priority LOW 27

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results.

CVSS 3.1MEDIUM 5.8 Network Low privileges User interaction EPSS 0.00765 Published 2020-10-26 Fixed in 2.5.162 CWE-79
Open these records in search →