Read the docs

YesWiki

Records86All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high41CVSS 7.0–8.9

Exploited now

YesWiki records in CISA KEV

No YesWiki vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Yeswiki 16 records HIGH Cercopitheque 1 record MEDIUM

Records

86 records

TI-2026-34305 CVE-2026-46670 · GHSA-jwvv-qr7q-cv8j

YesWiki: Unauthenticated SQL Injection

Priority HIGH 82

YesWiki is a wiki system written in PHP.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01992 Published 2026-08-11 Fixed in 4.6.4 CWE-89
TI-2026-80227 CVE-2026-116211 · GHSA-c22v-7hq8-8gqq

SQL injection in YesWiki Bazar entry creation via date_maj_fiche

Priority HIGH 77

YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00293 Published 2026-10-25 Fixed in 4.7.0 CWE-89
TI-2026-66106 CVE-2026-104464 · GHSA-ghw3-mg2w-7jg2

YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter

Priority HIGH 77

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00289 Published 2026-10-02 Fixed in 4.6.7 CWE-918
TI-2026-66104 CVE-2026-104462 · GHSA-mvpf-2445-p988

YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter

Priority HIGH 77

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00312 Published 2026-10-02 Fixed in 4.6.7 CWE-89
TI-2026-66102 CVE-2026-104460 · GHSA-3q4q-74cq-96xq

YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

Priority HIGH 77

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00385 Published 2026-10-02 Fixed in 4.6.7 CWE-89
TI-2026-66099 CVE-2026-104457 · GHSA-f8w7-2q27-5p28

YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

Priority HIGH 77

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00352 Published 2026-10-02 Fixed in 4.6.7 CWE-89
TI-2026-66109 CVE-2026-104467 · GHSA-59xh-vh54-x5hf

YesWiki before 4.6.7 Authorization Bypass via Public API Mode

Priority HIGH 75

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00367 Published 2026-10-02 Fixed in 4.6.7 CWE-862
TI-2026-66113 CVE-2026-104471 · GHSA-g4m2-8g7g-xw8c

YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

Priority HIGH 72

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00372 Published 2026-10-02 Fixed in 4.6.7 CWE-434
TI-2026-80984 CVE-2026-116820 · GHSA-9vjw-qm94-65hm

SQL query disclosure in YesWiki via showreq parameter

Priority HIGH 70

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00231 Published 2026-10-26 Fixed in 4.7.0 CWE-215
TI-2026-80223 CVE-2026-116205 · GHSA-fxcp-jrx4-gvc5

Unauthenticated SSRF in YesWiki via raw-inclusion wiki syntax

Priority HIGH 70

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0051 Published 2026-10-25 Fixed in 4.7.0 CWE-918
TI-2026-66101 CVE-2026-104459 · GHSA-pg4j-r96p-6rg4

YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle

Priority HIGH 70

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00388 Published 2026-10-02 Fixed in 4.6.7 CWE-918
TI-2026-66097 CVE-2026-104455 · GHSA-x8xj-595c-jcc3

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action

Priority HIGH 70

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00366 Published 2026-10-02 Fixed in 4.6.7 CWE-200
TI-2026-66096 CVE-2026-104454 · GHSA-j46p-q3g4-r6r6

YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint

Priority HIGH 70

YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00401 Published 2026-10-02 Fixed in 4.6.7 CWE-1333
Load more
Open these records in search →