{"schema_version":1,"title":"YesWiki vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 16 vulnerabilities in YesWiki: 0 in the last 7 days and 13 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-52777, was published on 5 September 2026.","url":"https://junglewise.ai/threats/technologies/yeswiki","json_url":"https://junglewise.ai/threats/technologies/yeswiki.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/yeswiki","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":7,"all_time":16,"critical":4,"exploited":0,"last_7_days":0,"last_30_days":12,"last_90_days":13,"last_365_days":15},"latest":[{"cve":"CVE-2026-52777","cvss":4,"epss":0.0028,"slug":"cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImport","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:20.663+00:00","url":"https://junglewise.ai/threats/cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction"},{"cve":"CVE-2026-52775","cvss":8.8,"epss":0.0048,"slug":"cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vuln","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:20.52+00:00","url":"https://junglewise.ai/threats/cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager"},{"cve":"CVE-2026-52774","cvss":6.1,"epss":0.0066,"slug":"cve-2026-52774-yeswiki-reflected-xss-in-bazar-widget-id-parameter","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attr","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:20.38+00:00","url":"https://junglewise.ai/threats/cve-2026-52774-yeswiki-reflected-xss-in-bazar-widget-id-parameter"},{"cve":"CVE-2026-52773","cvss":6.1,"epss":0.0059,"slug":"cve-2026-52773-yeswiki-reflected-xss-in-archived-revision-view","title":"YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:20.243+00:00","url":"https://junglewise.ai/threats/cve-2026-52773-yeswiki-reflected-xss-in-archived-revision-view"},{"cve":"CVE-2026-52772","cvss":5.5,"epss":0.0034,"slug":"cve-2026-52772-yeswiki-stored-xss-in-bazar-form-field-templates","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:20.11+00:00","url":"https://junglewise.ai/threats/cve-2026-52772-yeswiki-stored-xss-in-bazar-form-field-templates"},{"cve":"CVE-2026-52771","cvss":8.3,"epss":0.0051,"slug":"cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage","title":"YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag ret","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.963+00:00","url":"https://junglewise.ai/threats/cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage"},{"cve":"CVE-2026-52770","cvss":7.5,"epss":0.0047,"slug":"cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.827+00:00","url":"https://junglewise.ai/threats/cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis"},{"cve":"CVE-2026-52769","cvss":8.3,"epss":0.0049,"slug":"cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - expose","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing"},{"cve":"CVE-2026-52767","cvss":8.2,"epss":0.0035,"slug":"cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the resu","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.54+00:00","url":"https://junglewise.ai/threats/cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in"},{"cve":"CVE-2026-52766","cvss":9.1,"epss":0.0058,"slug":"cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:19.393+00:00","url":"https://junglewise.ai/threats/cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action"},{"cve":"CVE-2026-52763","cvss":6.5,"epss":0.0038,"slug":"cve-2026-52763-yeswiki-sql-injection-in-recentchanges-action-period-argument","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argum","severity":"medium","exploited":false,"published_at":"2026-09-05T00:17:19.257+00:00","url":"https://junglewise.ai/threats/cve-2026-52763-yeswiki-sql-injection-in-recentchanges-action-period-argument"},{"cve":"CVE-2026-52762","cvss":4,"epss":0.0078,"slug":"cve-2026-52762-yeswiki-rce-via-server-side-template-injection-in-bazar-semantic","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulne","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:18.607+00:00","url":"https://junglewise.ai/threats/cve-2026-52762-yeswiki-rce-via-server-side-template-injection-in-bazar-semantic"},{"cve":"CVE-2026-46670","cvss":9.8,"epss":0.0199,"slug":"cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManag","severity":"critical","exploited":false,"published_at":"2026-08-11T14:17:13.863+00:00","url":"https://junglewise.ai/threats/cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager"},{"cve":"CVE-2026-52778","cvss":9.8,"epss":0.0094,"slug":"cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator","title":"YesWiki code injection and ReDoS in Bazar form field calculator","severity":"critical","exploited":false,"published_at":"2026-06-08T19:16:46.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator"},{"cve":"CVE-2026-34598","cvss":6.1,"epss":0.0031,"slug":"cve-2026-34598-yeswiki-stored-xss-in-form-title-field","title":"YesWiki stored XSS in form title field","severity":"high","exploited":false,"published_at":"2026-04-02T18:16:31.74+00:00","url":"https://junglewise.ai/threats/cve-2026-34598-yeswiki-stored-xss-in-form-title-field"},{"cve":"CVE-2025-52277","cvss":6.1,"epss":0.0039,"slug":"cve-2025-52277-yeswiki-stored-xss-in-meta-robots-configuration-field","title":"YesWiki stored XSS in meta robots configuration field","severity":"medium","exploited":false,"published_at":"2025-09-09T15:15:33.357+00:00","url":"https://junglewise.ai/threats/cve-2025-52277-yeswiki-stored-xss-in-meta-robots-configuration-field"}],"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":2,"exploited":0,"vulnerabilities":12},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"YesWiki","slug":"yeswiki","vendor":{"name":"YesWiki","slug":"yeswiki","url":"https://junglewise.ai/threats/vendors/yeswiki"},"aliases":[],"category":"cms","homepage":"https://yeswiki.net/","repo_url":"https://github.com/YesWiki/yeswiki","description":"YesWiki is a lightweight, multilingual wiki engine based on WakkaWiki.","url":"https://junglewise.ai/threats/technologies/yeswiki"},"most_severe":[{"cve":"CVE-2026-46670","cvss":9.8,"epss":0.0199,"slug":"cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManag","severity":"critical","exploited":false,"published_at":"2026-08-11T14:17:13.863+00:00","url":"https://junglewise.ai/threats/cve-2026-46670-yeswiki-sql-injection-in-bazar-formmanager"},{"cve":"CVE-2026-52778","cvss":9.8,"epss":0.0094,"slug":"cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator","title":"YesWiki code injection and ReDoS in Bazar form field calculator","severity":"critical","exploited":false,"published_at":"2026-06-08T19:16:46.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52778-yeswiki-code-injection-and-redos-in-bazar-form-field-calculator"},{"cve":"CVE-2026-52766","cvss":9.1,"epss":0.0058,"slug":"cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:19.393+00:00","url":"https://junglewise.ai/threats/cve-2026-52766-yeswiki-missing-authorization-in-erasespamedcomments-action"},{"cve":"CVE-2026-52777","cvss":4,"epss":0.0028,"slug":"cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImport","severity":"critical","exploited":false,"published_at":"2026-09-05T00:17:20.663+00:00","url":"https://junglewise.ai/threats/cve-2026-52777-yeswiki-php-object-injection-in-bazarimportaction"},{"cve":"CVE-2026-52775","cvss":8.8,"epss":0.0048,"slug":"cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vuln","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:20.52+00:00","url":"https://junglewise.ai/threats/cve-2026-52775-yeswiki-authenticated-sql-injection-in-reactionmanager"},{"cve":"CVE-2026-52771","cvss":8.3,"epss":0.0051,"slug":"cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage","title":"YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag ret","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.963+00:00","url":"https://junglewise.ai/threats/cve-2026-52771-yeswiki-second-order-sql-injection-in-apicontroller-deletepage"},{"cve":"CVE-2026-52769","cvss":8.3,"epss":0.0049,"slug":"cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - expose","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.683+00:00","url":"https://junglewise.ai/threats/cve-2026-52769-yeswiki-ssrf-in-activitypub-signature-keyid-parsing"},{"cve":"CVE-2026-52767","cvss":8.2,"epss":0.0035,"slug":"cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in","title":"YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the resu","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.54+00:00","url":"https://junglewise.ai/threats/cve-2026-52767-yeswiki-activitypub-signature-verification-bypass-in"},{"cve":"CVE-2026-52770","cvss":7.5,"epss":0.0047,"slug":"cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis","title":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated","severity":"high","exploited":false,"published_at":"2026-09-05T00:17:19.827+00:00","url":"https://junglewise.ai/threats/cve-2026-52770-yeswiki-sql-injection-in-bazar-entry-listing-apis"},{"cve":"CVE-2026-34598","cvss":6.1,"epss":0.0031,"slug":"cve-2026-34598-yeswiki-stored-xss-in-form-title-field","title":"YesWiki stored XSS in form title field","severity":"high","exploited":false,"published_at":"2026-04-02T18:16:31.74+00:00","url":"https://junglewise.ai/threats/cve-2026-34598-yeswiki-stored-xss-in-form-title-field"}],"generated_at":"2026-09-28T03:07:00.154823+00:00"}