Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

14 records

Vendor: Requarks Component: Wiki.js Clear all filters
TI-2021-07999 CVE-2021-25993 · GHSA-42pj-96jc-q58w

Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor

Priority MEDIUM 58

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in th…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00639 Published 2021-12-29 No fix listed CWE-79
TI-2021-19661 CVE-2021-43855

Stored XSS via SVG in Requarks/wiki

Priority LOW 37

Wiki.js is a wiki app built on node.js.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.00916 Published 2021-12-27 Fixed in 2.5.264 CWE-79
TI-2021-04482 CVE-2021-21383

XSS in Wiki.js

Priority LOW 35

Wiki.js an open-source wiki app built on Node.js.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00971 Published 2021-03-18 Fixed in 2.5.191 CWE-79
TI-2020-12044 CVE-2020-15274

Stored XSS via search result in Wiki.js

Priority LOW 27

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results.

CVSS 3.1MEDIUM 5.8 Network Low privileges User interaction EPSS 0.00765 Published 2020-10-26 Fixed in 2.5.162 CWE-79
TI-2020-12008 CVE-2020-15236

Directory Traversal in Wiki.js

Priority MEDIUM 41

In Wiki.js before version 2.5.151, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01766 Published 2020-10-05 Fixed in 2.5.151 CWE-22
TI-2020-03541 CVE-2020-4052

Stored XSS through template injection in Wiki.js

Priority LOW 30

In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00856 Published 2020-06-16 Fixed in 2.4.107 CWE-79
TI-2020-08925 CVE-2020-11051

XSS in Wiki.js

Priority LOW 31

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0061 Published 2020-05-05 Fixed in 2.3.81 CWE-79