Yeswiki vulnerabilities
82 CVEs and advisories name Yeswiki as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116828YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
- CVE-2026-116827YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
- CVE-2026-116826YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
- CVE-2026-116825YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
- CVE-2026-116824YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
- CVE-2026-116823YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
- CVE-2026-116822YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
- CVE-2026-116821YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
- CVE-2026-116820YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
- CVE-2026-116211YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
- CVE-2026-116208YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
- CVE-2026-116207YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
- CVE-2026-116206YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
- CVE-2026-116205YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
- CVE-2026-116204YesWiki before 4.7.0 CSRF via despam Admin Action
- CVE-2026-116203YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
- CVE-2026-116202YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
- CVE-2026-105224YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
- CVE-2026-104473YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
- CVE-2026-104472YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
- CVE-2026-104471YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
- CVE-2026-104470YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter
- CVE-2026-104469YesWiki before 4.6.7 Session Fixation via Login in AuthController.php
- CVE-2026-104468YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction
- CVE-2026-104467YesWiki before 4.6.7 Authorization Bypass via Public API Mode
- CVE-2026-104466YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
- CVE-2026-104465YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
- CVE-2026-104464YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter
- CVE-2026-104463YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox
- CVE-2026-104462YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter