Technology · Packagist
yeswiki/yeswiki (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 31 vulnerabilities in yeswiki/yeswiki (Packagist): 0 in the last 7 days and 12 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-52777, was published on 5 September 2026. Nothing was published in the last eight weeks.
- Last 7 days
- 0
- Last 90 days
- 12
- Critical, all time
- 4
- Exploited in the wild
- 0
About yeswiki/yeswiki (Packagist)
YesWiki is a lightweight, collaborative wiki engine designed for easy content creation and community collaboration.
Latest yeswiki/yeswiki (Packagist) vulnerabilities
- CVE-2026-52777: YesWiki PHP object injection in BazarImportActioncriticalCVSS 4EPSS 0.3%
- CVE-2026-52775: YesWiki authenticated SQL injection in ReactionManagerhighCVSS 8.8EPSS 0.5%
- CVE-2026-52774: YesWiki reflected XSS in Bazar widget id parametermediumCVSS 6.1EPSS 0.7%
- CVE-2026-52773: YesWiki reflected XSS in archived-revision viewmediumCVSS 6.1EPSS 0.6%
- CVE-2026-52772: YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to…mediumCVSS 5.5EPSS 0.3%
- CVE-2026-52771: YesWiki second-order SQL injection in ApiController::deletePagehighCVSS 8.3EPSS 0.5%
- CVE-2026-52770: YesWiki SQL injection in Bazar entry-listing APIshighCVSS 7.5EPSS 0.5%
- CVE-2026-52769: YesWiki SSRF in ActivityPub Signature keyId parsinghighCVSS 8.3EPSS 0.5%
- CVE-2026-52767: YesWiki ActivityPub signature verification bypass in HttpSignatureServicehighCVSS 8.2EPSS 0.4%
- CVE-2026-52766: YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action…criticalCVSS 9.1EPSS 0.6%
- CVE-2026-52763: YesWiki SQL injection in recentchanges action period argumentmediumCVSS 6.5EPSS 0.4%
- CVE-2026-52762: YesWiki RCE via Server-Side Template Injection in Bazar Semantic TemplateshighCVSS 4EPSS 0.8%
- CVE-2026-46670: YesWiki SQL injection in Bazar FormManagercriticalCVSS 9.8EPSS 2.0%
- CVE-2026-52778: YesWiki code injection and ReDoS in Bazar form field calculatorcriticalCVSS 9.8EPSS 0.9%
- CVE-2026-41143: YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()lowCVSS 3.1EPSS 0.5%
- CVE-2026-34598: YesWiki stored XSS in form title fieldhighCVSS 6.1EPSS 0.3%
- YesWiki has Multiple Reflected Cross-site Scripting VulnerabilitiesmediumCVSS 4
- CVE-2025-52277: YesWiki stored XSS in meta robots configuration fieldmediumCVSS 6.1EPSS 0.4%
- CVE-2025-46346: YesWiki Stored XSS Vulnerability in CommentsmediumCVSS 4EPSS 0.4%
- CVE-2025-46347: YesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionmediumCVSS 4EPSS 1.0%
- CVE-2025-46348: YesWiki Vulnerable to Unauthenticated Site Backup Creation and DownloadlowCVSS 3.1EPSS 0.7%
- CVE-2025-46349: YesWiki Vulnerable to Unauthenticated Reflected Cross-site ScriptinglowCVSS 3.1EPSS 0.6%
- CVE-2025-46350: Yeswiki Vulnerable to Authenticated Reflected Cross-site ScriptinglowCVSS 3.1EPSS 0.3%
- CVE-2025-46550: Yeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptinglowCVSS 3.1EPSS 0.5%
- CVE-2025-46549: Yeswiki Vulnerable to Unauthenticated Reflected Cross-site ScriptinglowCVSS 3.1EPSS 0.5%
Most severe yeswiki/yeswiki (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-46670: YesWiki SQL injection in Bazar FormManagercriticalCVSS 9.8EPSS 2.0%
- CVE-2026-52778: YesWiki code injection and ReDoS in Bazar form field calculatorcriticalCVSS 9.8EPSS 0.9%
- CVE-2026-52766: YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action…criticalCVSS 9.1EPSS 0.6%
- CVE-2026-52777: YesWiki PHP object injection in BazarImportActioncriticalCVSS 4EPSS 0.3%
- CVE-2026-52775: YesWiki authenticated SQL injection in ReactionManagerhighCVSS 8.8EPSS 0.5%
- CVE-2026-52771: YesWiki second-order SQL injection in ApiController::deletePagehighCVSS 8.3EPSS 0.5%
- CVE-2026-52769: YesWiki SSRF in ActivityPub Signature keyId parsinghighCVSS 8.3EPSS 0.5%
- CVE-2026-52767: YesWiki ActivityPub signature verification bypass in HttpSignatureServicehighCVSS 8.2EPSS 0.4%
- CVE-2026-52770: YesWiki SQL injection in Bazar entry-listing APIshighCVSS 7.5EPSS 0.5%
- CVE-2026-34598: YesWiki stored XSS in form title fieldhighCVSS 6.1EPSS 0.3%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 12 | 2 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many yeswiki/yeswiki (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/yeswiki-yeswiki)<a href="https://junglewise.ai/threats/technologies/yeswiki-yeswiki"><img src="https://junglewise.ai/threats/technologies/yeswiki-yeswiki/badge.svg" alt="yeswiki/yeswiki (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/yeswiki-yeswiki.json, and this page as text at https://junglewise.ai/threats/technologies/yeswiki-yeswiki.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "yeswiki/yeswiki (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/yeswiki-yeswiki, 10 November 2026.