yeswiki has 68 CVEs on record. Disclosure cadence is accelerating: 66 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 54. The median CVSS is 6.5 (medium), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (14) and CWE-89 (12). Most affected products: yeswiki (67), yeswiki/yeswiki (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 66 prev 1
Weakness classes
Products
- yeswiki 67
- yeswiki/yeswiki 1
Worst active — by depth score
CVE-2026-52766Critical· 9.1YesWiki is a wiki system written in PHP62CVE-2026-52775High· 8.8YesWiki is a wiki system written in PHP60CVE-2026-104464High· 8.6YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action59CVE-2026-104457High· 8.6YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause59CVE-2026-52769High· 8.3YesWiki is a wiki system written in PHP58
yeswiki vulnerabilities
CVEs affecting yeswiki, newest first. Open any entry for full detail, references, and exploit status.
68 CVEsRSS
CVE-2026-52771High· 8.3YesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping.…
CVE-2026-52772Medium· 5.5PoCYesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has b…
CVE-2026-52773Medium· 6.1PoCYesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coer…
CVE-2026-52774Medium· 6.1PoCYesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker c…
CVE-2026-52775High· 8.8PoCYesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject a…
CVE-2026-52777Critical· 9.4YesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
CVE-2026-52778Critical· 9.8YesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formu…
CVE-2026-34598Medium· 6.1YesWiki is a wiki system written in PHP
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in…