CVE-2026-24135

CVE-2026-24135: Eliminación Arbitraria de Archivos en Gogs mediante Path Traversal en Wiki Severidad: Alta CVSS 7.5 Software Afectado: Gogs Parcheado en: 0.13.4, 0.14.0+dev Aviso: GHSA-jp7c-wj6q-3qf2 Parche: gogs/gogs8099 Resumen Durante una auditoría de seguridad de Gogs un popular servicio Git...

apache__jspwiki_CVE-2019-0225_2-11-0-M2

Apache JSPWiki 2.11 - Documentation root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

apache__jspwiki_CVE-2019-10077_2-11-0-M3

Apache JSPWiki 2.11 - Documentación root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

apache__jspwiki_CVE-2019-10076_2-11-0-M3

Apache JSPWiki 2.11 - 文档 root@kitploit: 根据 Apache 软件基金会（ASF）的一项或多项贡献者许可协议，进行许可。 请参阅随本作品分发的 NOTICE 文件，了解有关版权所有权的更多信息。 ASF 根据 Apache 许可证 2.0 版本（“许可证”）向你授予本文件许可； 除非遵守本许可证，否则你不得使用本文件。 你可以在以下位置获取许可证副本： http://www.apache.org/licenses/LICENSE-2.0 除非适用法律要求或书面同意，否则根据本许可证分发的软件是按“原样”分发的， 不附带任何明示或暗示的保证或条件。...

apache__jspwiki_CVE-2019-10078_2-11-0-M3

Apache JSPWiki 2.12 - Documentación root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

apache__jspwiki_CVE-2022-46907_2-11-3

Apache JSPWiki 2.11 - Documentación root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

specula

La información para comenzar y para desarrollar tus propios módulos está disponible en la wiki...

[SECURITY] Fedora 43 Update: dokuwiki-20250514b-6.fc43

DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creati ng documentation of any kind. It has a simple but powerful syntax which makes su re the data-files remain readable outside the Wiki and eases the creation of structured texts. All data is stored in plain text files no...

CVE-2026-52772

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6...

CVE-2026-52766

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the erasespamedcomments wiki action actions/EraseSpamedCommentsAction.php accepts a suppr array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the...

EUVD-2026-71807

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52771 YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

CVE-2026-53528

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could...

CVE-2026-53529 LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

EUVD-2026-64177

LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could...

CVE-2026-53527 LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update

LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as viewer, to admin. Exploitation requires a valid...

CVE-2026-53527 LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update

LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as viewer, to admin. Exploitation requires a valid...

CVE-2026-52854: Improper Neutralization of Input During Web Page Generation

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

CVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

CVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...