Technology · YesWiki
YesWiki vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 70 vulnerabilities in YesWiki: 0 in the last 7 days and 66 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116828, was published on 27 October 2026. 17 vulnerabilities in the last four weeks, down 54% on the four before (37). 1 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 66
- Critical, all time
- 5
- Exploited in the wild
- 0
About YesWiki
Open-source wiki engine with collaborative editing and customizable templates.
Latest YesWiki vulnerabilities
- CVE-2026-116828: YesWiki SQL injection in despam.php INTERVAL operandmediumCVSS 4.9
- CVE-2026-116827: YesWiki server-side request forgery in Bazar CSV importmediumCVSS 6.8
- CVE-2026-116826: YesWiki server-side request forgery in DuplicationManagermediumCVSS 6.8
- CVE-2026-116825: YesWiki HTTP Signature replay protection missing in ActivityPub inboxmediumCVSS 6.5
- CVE-2026-116824: YesWiki stored cross-site scripting in referrers_sites handlermediumCVSS 6.1
- CVE-2026-116823: YesWiki reflected cross-site scripting in Bazar field renderingmediumCVSS 6.1
- CVE-2026-116822: YesWiki path traversal in BazarListeAction template parametermediumCVSS 5.3
- CVE-2026-116821: YesWiki read-ACL bypass via unescaped SQL LIKE wildcardsmediumCVSS 6.5
- CVE-2026-116820: YesWiki Bazar information disclosure via showreq parametermediumCVSS 5.3
- CVE-2026-116211: YesWiki SQL injection in PageManager via date_maj_fichehighCVSS 8.2
- CVE-2026-116208: YesWiki missing authorization in ActivityPub synchighCVSS 8.1
- CVE-2026-116207: YesWiki SQL injection in Bazar search API via backtick in field namescriticalCVSS 9.1
- CVE-2026-116206: YesWiki stored cross-site scripting in comment bodiesmediumCVSS 6.4
- CVE-2026-116205: YesWiki server-side request forgery in page render handlermediumCVSS 5.3
- CVE-2026-116204: YesWiki cross-site request forgery in despam actionhighCVSS 8.1
- CVE-2026-116203: YesWiki stored cross-site scripting in filtertags actionmediumCVSS 6.1
- CVE-2026-116202: YesWiki stored XSS in ImageField SVG uploadmediumCVSS 5.4
- CVE-2026-105224: YesWiki Bazar valeur action cross-site scriptingmediumCVSS 5.4EPSS 0.2%
- CVE-2026-104473: YesWiki reflected cross-site scripting in multiple parametersmediumCVSS 6.1EPSS 0.2%
- CVE-2026-104472: YesWiki missing authorization in attachment download handlerhighCVSS 7.5EPSS 0.4%
- CVE-2026-104471: YesWiki unrestricted file upload in Bazar CSV importhighCVSS 7.2EPSS 0.4%
- CVE-2026-104470: YesWiki Bazar valeur action server-side request forgerymediumCVSS 5EPSS 0.2%
- CVE-2026-104469: YesWiki session fixation in loginmediumCVSS 6.8EPSS 0.2%
- CVE-2026-104468: YesWiki password reset token insufficient expirationmediumCVSS 4.8EPSS 0.3%
- CVE-2026-104467: YesWiki authorization bypass in public API modehighCVSS 8.1EPSS 0.4%
Most severe YesWiki vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-46670: YesWiki SQL injection in Bazar FormManagercriticalCVSS 9.8EPSS 2.0%
- CVE-2026-52778: YesWiki code injection and ReDoS in Bazar form field calculatorcriticalCVSS 9.8EPSS 0.9%
- CVE-2026-52766: YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action…criticalCVSS 9.1EPSS 0.6%
- CVE-2026-116207: YesWiki SQL injection in Bazar search API via backtick in field namescriticalCVSS 9.1
- CVE-2026-52777: YesWiki PHP object injection in BazarImportActioncriticalCVSS 4EPSS 0.3%
- CVE-2026-52775: YesWiki authenticated SQL injection in ReactionManagerhighCVSS 8.8EPSS 0.5%
- CVE-2026-104464: YesWiki server-side request forgery in Bazar abonnements synchighCVSS 8.6EPSS 0.3%
- CVE-2026-104457: YesWiki SQL injection in Bazar filtertags actionhighCVSS 8.6EPSS 0.3%
- CVE-2026-52771: YesWiki second-order SQL injection in ApiController::deletePagehighCVSS 8.3EPSS 0.5%
- CVE-2026-52769: YesWiki SSRF in ActivityPub Signature keyId parsinghighCVSS 8.3EPSS 0.5%
Vulnerabilities per week
17 vulnerabilities in the last four weeks, down 54% on the four before (37). 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 12 | 2 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 37 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 8 | 1 | |
| 26 Oct 2026 | 9 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many YesWiki vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/yeswiki)<a href="https://junglewise.ai/threats/technologies/yeswiki"><img src="https://junglewise.ai/threats/technologies/yeswiki/badge.svg" alt="YesWiki vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/yeswiki.json, and this page as text at https://junglewise.ai/threats/technologies/yeswiki.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "YesWiki vulnerabilities", https://junglewise.ai/threats/technologies/yeswiki, 10 November 2026.