Security
فارسی
All products

yeswiki/yeswiki

Composer · Package
31 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
YesWiki has Multiple Reflected Cross-site Scripting VulnerabilitiesCVE-2026-104473 · GHSA-5724-X3RH-5QQQ yeswiki/yeswiki Composer Medium Fix reported
YesWiki: Unauthenticated SQL InjectionCVE-2026-46670 · GHSA-JWVV-QR7Q-CV8J yeswiki/yeswiki Composer Critical Fix reported
YesWiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingCVE-2025-46349 · GHSA-2F8P-QQX2-GWR2 yeswiki/yeswiki Composer High No fix reported
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingCVE-2025-46549 · GHSA-R9GV-QFFM-XW6F yeswiki/yeswiki Composer Medium Fix reported
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptingCVE-2025-46550 · GHSA-GGQX-43H2-55JP yeswiki/yeswiki Composer Medium Fix reported
Yeswiki Vulnerable to Authenticated Reflected Cross-site ScriptingCVE-2025-46350 · GHSA-CG4F-CQ8H-3CH8 yeswiki/yeswiki Composer Low Fix reported
YesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionCVE-2025-46347 · GHSA-88XG-V53P-FPVF yeswiki/yeswiki Composer High Fix reported
YesWiki Stored XSS Vulnerability in Comments CVE-2025-46346 · GHSA-59X8-CVXH-3MM4 yeswiki/yeswiki Composer Low Fix reported
Authenticated Stored XSS in YesWikiCVE-2025-24018 · GHSA-W59H-3X3Q-3P6J yeswiki/yeswiki Composer High Fix reported
YesWiki Vulnerable to Unauthenticated Site Backup Creation and DownloadCVE-2025-46348 · GHSA-WC9G-6J9W-HR95 yeswiki/yeswiki Composer Critical Fix reported
YesWiki has Authenticated SQL Injection via ReactionManager CVE-2026-52775 · GHSA-4PF7-CC4R-G63H yeswiki/yeswiki Composer High Fix reported
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))CVE-2026-52772 · GHSA-XC7J-3G8Q-9VH4 yeswiki/yeswiki Composer Medium Fix reported
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)CVE-2026-52771 · GHSA-8F2V-2QHJ-GFWG yeswiki/yeswiki Composer High Fix reported
YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserializeCVE-2026-52777 · GHSA-9369-69WJ-7M2F yeswiki/yeswiki Composer Critical Fix reported
YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML AttributesCVE-2026-52774 · GHSA-R5XW-GCGW-HWP5 yeswiki/yeswiki Composer Medium Fix reported
YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`CVE-2026-52773 · GHSA-35F3-PG38-486F yeswiki/yeswiki Composer Medium Fix reported
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filtersCVE-2026-52770 · GHSA-QG78-VMVC-FHJW yeswiki/yeswiki Composer High Fix reported
YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of ServiceCVE-2026-52778 · GHSA-PX5M-H76G-P7P8 yeswiki/yeswiki Composer Critical Fix reported
YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`CVE-2026-52769 · GHSA-VW42-752G-5MRP yeswiki/yeswiki Composer High Fix reported
YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` actionCVE-2026-52766 · GHSA-6X7X-GCMF-7R8X yeswiki/yeswiki Composer Critical Fix reported