{"schema_version":1,"title":"yeswiki/yeswiki (Packagist) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 31 vulnerabilities in yeswiki/yeswiki (Packagist): 0 in the last 7 days and 13 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-52777, was published on 5 September 2026.","url":"https://junglewise.ai/threats/technologies/yeswiki-yeswiki","json_url":"https://junglewise.ai/threats/technologies/yeswiki-yeswiki.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/yeswiki-yeswiki","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":7,"all_time":31,"critical":4,"exploited":0,"last_7_days":0,"last_30_days":12,"last_90_days":13,"last_365_days":17},"latest":[{"cve":"CVE-2026-52777","cvss":4,"epss":0.0028,"slug":"cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImport","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:20.663+00:00","url":"https://junglewise.ai/threats/cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction"},{"cve":"CVE-2026-52775","cvss":8.8,"epss":0.0048,"slug":"cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vuln","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:20.52+00:00","url":"https://junglewise.ai/threats/cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager"},{"cve":"CVE-2026-52774","cvss":6.1,"epss":0.0066,"slug":"cve-2026-52774-yeswiki-reflected-xss-in-bazar-widget-id-parameter","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attr","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:20.38+00:00","url":"https://junglewise.ai/threats/cve-2026-52774-yeswiki-reflected-xss-in-bazar-widget-id-parameter"},{"cve":"CVE-2026-52773","cvss":6.1,"epss":0.0059,"slug":"cve-2026-52773-yeswiki-reflected-xss-in-archived-revision-view","title":"YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:20.243+00:00","url":"https://junglewise.ai/threats/cve-2026-52773-yeswiki-reflected-xss-in-archived-revision-view"},{"cve":"CVE-2026-52772","cvss":5.5,"epss":0.0034,"slug":"cve-2026-52772-yeswiki-stored-xss-in-bazar-form-field-templates","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:20.11+00:00","url":"https://junglewise.ai/threats/cve-2026-52772-yeswiki-stored-xss-in-bazar-form-field-templates"},{"cve":"CVE-2026-52771","cvss":8.3,"epss":0.0051,"slug":"cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage","title":"YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag ret","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.963+00:00","url":"https://junglewise.ai/threats/cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage"},{"cve":"CVE-2026-52770","cvss":7.5,"epss":0.0047,"slug":"cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.827+00:00","url":"https://junglewise.ai/threats/cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis"},{"cve":"CVE-2026-52769","cvss":8.3,"epss":0.0049,"slug":"cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - expose","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing"},{"cve":"CVE-2026-52767","cvss":8.2,"epss":0.0035,"slug":"cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the resu","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.54+00:00","url":"https://junglewise.ai/threats/cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in"},{"cve":"CVE-2026-52766","cvss":9.1,"epss":0.0058,"slug":"cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:19.393+00:00","url":"https://junglewise.ai/threats/cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action"},{"cve":"CVE-2026-52763","cvss":6.5,"epss":0.0038,"slug":"cve-2026-52763-yeswiki-sql-injection-in-recentchanges-action-period-argument","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argum","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:19.257+00:00","url":"https://junglewise.ai/threats/cve-2026-52763-yeswiki-sql-injection-in-recentchanges-action-period-argument"},{"cve":"CVE-2026-52762","cvss":4,"epss":0.0078,"slug":"cve-2026-52762-yeswiki-rce-via-server-side-template-injection-in-bazar-semantic","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulne","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:18.607+00:00","url":"https://junglewise.ai/threats/cve-2026-52762-yeswiki-rce-via-server-side-template-injection-in-bazar-semantic"},{"cve":"CVE-2026-46670","cvss":9.8,"epss":0.0199,"slug":"cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManag","severity":"critical","exploited":false,"published_at":"2026-08-11T14:17:13.863+00:00","url":"https://junglewise.ai/threats/cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager"},{"cve":"CVE-2026-52778","cvss":9.8,"epss":0.0094,"slug":"cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator","title":"YesWiki code injection and ReDoS in Bazar form field calculator","severity":"critical","exploited":false,"published_at":"2026-06-08T19:16:46.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator"},{"cve":"CVE-2026-41143","cvss":3.1,"epss":0.0046,"slug":"cve-2026-41143-yeswiki-vulnerable-to-authenticated-sql-injection-via-id-fiche-in","title":"YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()","severity":"low","exploited":false,"published_at":"2026-04-18T01:00:30+00:00","url":"https://junglewise.ai/threats/cve-2026-41143-yeswiki-vulnerable-to-authenticated-sql-injection-via-id-fiche-in"},{"cve":"CVE-2026-34598","cvss":6.1,"epss":0.0031,"slug":"cve-2026-34598-yeswiki-stored-xss-in-form-title-field","title":"YesWiki stored XSS in form title field","severity":"high","exploited":false,"published_at":"2026-04-02T18:16:31.74+00:00","url":"https://junglewise.ai/threats/cve-2026-34598-yeswiki-stored-xss-in-form-title-field"},{"cvss":4,"slug":"yeswiki-has-multiple-reflected-cross-site-scripting-vulnerabilities-b4d2e600","title":"YesWiki has Multiple Reflected Cross-site Scripting Vulnerabilities","severity":"medium","exploited":false,"published_at":"2026-04-01T00:24:13+00:00","url":"https://junglewise.ai/threats/yeswiki-has-multiple-reflected-cross-site-scripting-vulnerabilities-b4d2e600"},{"cve":"CVE-2025-52277","cvss":6.1,"epss":0.0039,"slug":"cve-2025-52277-yeswiki-stored-xss-in-meta-robots-configuration-field","title":"YesWiki stored XSS in meta robots configuration field","severity":"medium","exploited":false,"published_at":"2025-09-09T15:15:33.357+00:00","url":"https://junglewise.ai/threats/cve-2025-52277-yeswiki-stored-xss-in-meta-robots-configuration-field"},{"cve":"CVE-2025-46346","cvss":4,"epss":0.0035,"slug":"cve-2025-46346-yeswiki-stored-xss-vulnerability-in-comments","title":"YesWiki Stored XSS Vulnerability in Comments","severity":"medium","exploited":false,"published_at":"2025-04-29T14:49:12+00:00","url":"https://junglewise.ai/threats/cve-2025-46346-yeswiki-stored-xss-vulnerability-in-comments"},{"cve":"CVE-2025-46347","cvss":4,"epss":0.0102,"slug":"cve-2025-46347-yeswiki-remote-code-execution-via-arbitrary-php-file-write-and","title":"YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution","severity":"medium","exploited":false,"published_at":"2025-04-29T14:45:42+00:00","url":"https://junglewise.ai/threats/cve-2025-46347-yeswiki-remote-code-execution-via-arbitrary-php-file-write-and"},{"cve":"CVE-2025-46348","cvss":3.1,"epss":0.0065,"slug":"cve-2025-46348-yeswiki-vulnerable-to-unauthenticated-site-backup-creation-and","title":"YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download","severity":"low","exploited":false,"published_at":"2025-04-29T14:41:31+00:00","url":"https://junglewise.ai/threats/cve-2025-46348-yeswiki-vulnerable-to-unauthenticated-site-backup-creation-and"},{"cve":"CVE-2025-46349","cvss":3.1,"epss":0.0063,"slug":"cve-2025-46349-yeswiki-vulnerable-to-unauthenticated-reflected-cross-site","title":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","severity":"low","exploited":false,"published_at":"2025-04-29T14:38:12+00:00","url":"https://junglewise.ai/threats/cve-2025-46349-yeswiki-vulnerable-to-unauthenticated-reflected-cross-site"},{"cve":"CVE-2025-46350","cvss":3.1,"epss":0.0029,"slug":"cve-2025-46350-yeswiki-vulnerable-to-authenticated-reflected-cross-site","title":"Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting","severity":"low","exploited":false,"published_at":"2025-04-29T14:37:04+00:00","url":"https://junglewise.ai/threats/cve-2025-46350-yeswiki-vulnerable-to-authenticated-reflected-cross-site"},{"cve":"CVE-2025-46550","cvss":3.1,"epss":0.0054,"slug":"cve-2025-46550-yeswiki-vulnerable-to-unauthenticated-reflected-cross-site","title":"Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","severity":"low","exploited":false,"published_at":"2025-04-29T14:36:10+00:00","url":"https://junglewise.ai/threats/cve-2025-46550-yeswiki-vulnerable-to-unauthenticated-reflected-cross-site"},{"cve":"CVE-2025-46549","cvss":3.1,"epss":0.0054,"slug":"cve-2025-46549-yeswiki-vulnerable-to-unauthenticated-reflected-cross-site","title":"Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","severity":"low","exploited":false,"published_at":"2025-04-29T14:35:20+00:00","url":"https://junglewise.ai/threats/cve-2025-46549-yeswiki-vulnerable-to-unauthenticated-reflected-cross-site"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":2,"exploited":0,"vulnerabilities":12},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"getgrav/grav (Packagist)","slug":"getgrav-grav","vulnerabilities":63,"url":"https://junglewise.ai/threats/technologies/getgrav-grav"},{"name":"wwbn/avideo (Packagist)","slug":"wwbn-avideo","vulnerabilities":58,"url":"https://junglewise.ai/threats/technologies/wwbn-avideo"},{"name":"concrete5/concrete5 (Packagist)","slug":"concrete5-concrete5","vulnerabilities":46,"url":"https://junglewise.ai/threats/technologies/concrete5-concrete5"},{"name":"snipe/snipe-it (Packagist)","slug":"snipe-snipe-it","vulnerabilities":39,"url":"https://junglewise.ai/threats/technologies/snipe-snipe-it"},{"name":"thorsten/phpmyfaq (Packagist)","slug":"thorsten-phpmyfaq","vulnerabilities":34,"url":"https://junglewise.ai/threats/technologies/thorsten-phpmyfaq"},{"name":"phpmyfaq/phpmyfaq (Packagist)","slug":"phpmyfaq-phpmyfaq","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq"},{"name":"craftcms/cms (Packagist)","slug":"craftcms-cms","vulnerabilities":27,"url":"https://junglewise.ai/threats/technologies/craftcms-cms"},{"name":"mantisbt/mantisbt (Packagist)","slug":"mantisbt-mantisbt","vulnerabilities":26,"url":"https://junglewise.ai/threats/technologies/mantisbt-mantisbt"},{"name":"kimai/kimai (Packagist)","slug":"kimai-kimai","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/kimai-kimai"},{"name":"froxlor/froxlor (Packagist)","slug":"froxlor-froxlor","vulnerabilities":18,"url":"https://junglewise.ai/threats/technologies/froxlor-froxlor"},{"name":"twig/twig (Packagist)","slug":"twig-twig","vulnerabilities":14,"url":"https://junglewise.ai/threats/technologies/twig-twig"},{"name":"shopper/framework (Packagist)","slug":"shopper-framework","vulnerabilities":13,"url":"https://junglewise.ai/threats/technologies/shopper-framework"}],"technology":{"hub":true,"name":"yeswiki/yeswiki (Packagist)","slug":"yeswiki-yeswiki","vendor":{"name":"Packagist","slug":"packagist","url":"https://junglewise.ai/threats/vendors/packagist"},"aliases":[],"homepage":"https://yeswiki.net/","repo_url":"https://github.com/yeswiki/yeswiki","description":"A collaborative wiki platform based on the WakkaWiki engine.","url":"https://junglewise.ai/threats/technologies/yeswiki-yeswiki"},"most_severe":[{"cve":"CVE-2026-46670","cvss":9.8,"epss":0.0199,"slug":"cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManag","severity":"critical","exploited":false,"published_at":"2026-08-11T14:17:13.863+00:00","url":"https://junglewise.ai/threats/cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager"},{"cve":"CVE-2026-52778","cvss":9.8,"epss":0.0094,"slug":"cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator","title":"YesWiki code injection and ReDoS in Bazar form field calculator","severity":"critical","exploited":false,"published_at":"2026-06-08T19:16:46.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator"},{"cve":"CVE-2026-52766","cvss":9.1,"epss":0.0058,"slug":"cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:19.393+00:00","url":"https://junglewise.ai/threats/cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action"},{"cve":"CVE-2026-52777","cvss":4,"epss":0.0028,"slug":"cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImport","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:20.663+00:00","url":"https://junglewise.ai/threats/cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction"},{"cve":"CVE-2026-52775","cvss":8.8,"epss":0.0048,"slug":"cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vuln","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:20.52+00:00","url":"https://junglewise.ai/threats/cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager"},{"cve":"CVE-2026-52771","cvss":8.3,"epss":0.0051,"slug":"cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage","title":"YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag ret","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.963+00:00","url":"https://junglewise.ai/threats/cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage"},{"cve":"CVE-2026-52769","cvss":8.3,"epss":0.0049,"slug":"cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - expose","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing"},{"cve":"CVE-2026-52767","cvss":8.2,"epss":0.0035,"slug":"cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the resu","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.54+00:00","url":"https://junglewise.ai/threats/cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in"},{"cve":"CVE-2026-52770","cvss":7.5,"epss":0.0047,"slug":"cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.827+00:00","url":"https://junglewise.ai/threats/cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis"},{"cve":"CVE-2026-34598","cvss":6.1,"epss":0.0031,"slug":"cve-2026-34598-yeswiki-stored-xss-in-form-title-field","title":"YesWiki stored XSS in form title field","severity":"high","exploited":false,"published_at":"2026-04-02T18:16:31.74+00:00","url":"https://junglewise.ai/threats/cve-2026-34598-yeswiki-stored-xss-in-form-title-field"}],"generated_at":"2026-09-26T20:07:00.238639+00:00"}