Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

YesWiki — Vulnerabilities & Security Advisories 64

Browse all 64 CVE security advisories affecting YesWiki. AI-powered Chinese analysis, POCs, and references for each vulnerability.

YesWiki is a collaborative wiki platform designed for knowledge sharing and collective content creation. Historically, it has been vulnerable to multiple security issues including remote code execution (RCE), cross-site scripting (XSS), privilege escalation, and path traversal vulnerabilities, with 14 CVEs documented to date. These vulnerabilities often stem from insufficient input validation, improper access controls, and insecure default configurations. While no major public security incidents have been widely reported, the consistent discovery of vulnerabilities suggests ongoing security challenges. The platform's open-source nature allows for community-driven improvements, but users must remain vigilant about applying security patches and hardening configurations to mitigate potential risks.

Top products by YesWiki: yeswiki
CVE ID Title CVSS Severity Published
CVE-2026-104472 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler — yeswiki CWE-862 7.5 High 2026-10-02
CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages — yeswiki CWE-79 6.1 Medium 2026-10-02
CVE-2026-104471 YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import — yeswiki CWE-434 7.2 High 2026-10-02
CVE-2026-104469 YesWiki before 4.6.7 Session Fixation via Login in AuthController.php — yeswiki CWE-384 6.8 Medium 2026-10-02
CVE-2026-104470 YesWiki before 4.6.7 SSRF and XSS via Bazar valeur Action — yeswiki CWE-79 7.4 High 2026-10-02
CVE-2026-104468 YesWiki before 4.6.7 Non-Expiring Password Reset Tokens via LostPasswordAction — yeswiki CWE-613 4.8 Medium 2026-10-02
CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute — yeswiki CWE-79 5.4 Medium 2026-10-02
CVE-2026-104467 YesWiki before 4.6.7 Authorization Bypass via Public API Mode — yeswiki CWE-862 8.1 High 2026-10-02
CVE-2026-104465 YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler — yeswiki CWE-79 6.1 Medium 2026-10-02
CVE-2026-104464 YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter — yeswiki CWE-918 8.6 High 2026-10-02
CVE-2026-104463 YesWiki before 4.6.7 Unauthenticated SSRF via ActivityPub Inbox — yeswiki CWE-918 7.0 High 2026-10-02
CVE-2026-104462 YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter — yeswiki CWE-89 7.5 High 2026-10-02
CVE-2026-104461 YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField — yeswiki CWE-79 5.4 Medium 2026-10-02
CVE-2026-104460 YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch — yeswiki CWE-89 7.5 High 2026-10-02
CVE-2026-104458 YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses — yeswiki CWE-918 6.5 Medium 2026-10-02
CVE-2026-104459 YesWiki before 4.6.7 SSRF via ActivityPub WebFinger actor_handle — yeswiki CWE-918 6.5 Medium 2026-10-02
CVE-2026-104457 YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter — yeswiki CWE-89 8.6 High 2026-10-02
CVE-2026-104455 YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action — yeswiki CWE-200 5.3 Medium 2026-10-02
CVE-2026-104456 YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username — yeswiki CWE-89 7.6 High 2026-10-02
CVE-2026-104454 YesWiki before 4.6.7 ReDoS via wakka.php Edit-Preview Endpoint — yeswiki CWE-1333 5.3 Medium 2026-10-02
CVE-2026-104453 YesWiki before 4.6.7 CSRF Tag Deletion via admintag Action — yeswiki CWE-352 5.4 Medium 2026-10-02
CVE-2026-104452 YesWiki before 4.6.7 CSRF Attachment Deletion via filemanager Handler — yeswiki CWE-352 5.4 Medium 2026-10-02
CVE-2026-104451 YesWiki before 4.6.7 CSRF Page Revision Restore via RevisionsHandler — yeswiki CWE-352 4.3 Medium 2026-10-02
CVE-2026-104449 YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche — yeswiki CWE-639 6.5 Medium 2026-10-02
CVE-2026-104450 YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action — yeswiki CWE-79 6.5 Medium 2026-10-02
CVE-2026-104448 YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler — yeswiki CWE-352 8.1 High 2026-10-02
CVE-2026-104446 YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Contact Mail Handler — yeswiki CWE-306 6.5 Medium 2026-10-02
CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction — yeswiki CWE-352 7.1 High 2026-10-02
CVE-2026-104445 YesWiki before 4.6.7 Authentication Bypass via ActivityPub Inbox Actor Spoofing — yeswiki CWE-290 8.2 High 2026-10-02
CVE-2026-104443 YesWiki before 4.6.7 Scope Bypass via Triples Delete API — yeswiki CWE-863 8.1 High 2026-10-02

This page lists every published CVE security advisory associated with YesWiki. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.