Yeswiki vulnerabilities
82 CVEs and advisories name Yeswiki as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-52770Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki
- CVE-2026-52769YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
- CVE-2026-52767YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
- CVE-2026-52766YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
- CVE-2026-52763YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read
- CVE-2026-52762YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
- CVE-2026-46670YesWiki: Unauthenticated SQL Injection
- CVE-2026-52778YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
- CVE-2026-41143YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
- CVE-2026-34598YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"
- CVE-2025-46550Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
- CVE-2025-46549Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
- CVE-2025-46348YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
- CVE-2025-46350Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting
- CVE-2025-46349YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
- CVE-2025-46347YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
- CVE-2025-46346YesWiki Vulnerable to Stored XSS in Comments
- CVE-2025-31131Path Traversal allowing arbitrary read of files in Yeswiki
- CVE-2025-24019YesWiki vulnerable to authenticated arbitrary file deletion
- CVE-2025-24018YesWiki Vulnerable to Authenticated Stored XSS
- CVE-2025-24017YesWiki Vulnerable to Unauthenticated DOM Based XSS
- CVE-2024-51478Use of a Broken or Risky Cryptographic Algorithm in YesWiki