Critical
CVE-2026-52778
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 31
Reset filters
Critical
CVE-2026-52777
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
High
CVE-2026-52775
YesWiki has Authenticated SQL Injection via ReactionManager
Medium
CVE-2026-52774
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes
Medium
CVE-2026-52773
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`
Medium
CVE-2026-52772
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))
High
CVE-2026-52771
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
High
CVE-2026-52770
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
High
CVE-2026-52769
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
High
CVE-2026-52767
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
Critical
CVE-2026-52766
YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
Medium
CVE-2026-52763
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read
High
CVE-2026-52762
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
Critical
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
High
CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
Medium
CVE-2026-104473
YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities
High
CVE-2026-34598
YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"
Medium
CVE-2025-52277
YesWiki Cross Site Scripting vulnerability
Low
CVE-2025-46346
YesWiki Stored XSS Vulnerability in Comments
High
CVE-2025-46347
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
Critical
CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
High
CVE-2025-46349
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Low
CVE-2025-46350
Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting
Medium
CVE-2025-46550
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.