CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 es una vulnerabilidad XSS reflejado en el manejador de widgets Bazar de YesWiki. El parámetro de consulta en el endpoint NoSuchPage/widget está sanitizado de forma inadecuada mediante striptags, que no escapa las comillas dobles. Esto permite a un atacant...

CVE-2026-52762

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

CVE-2026-52762: Improper Neutralization of Special Elements Used in a Template Engine

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

EUVD-2026-71797

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

CVE-2026-52762

YesWiki (PHP wiki system) prior to version 4.6.6 is affected by a stored Server-Side Template Injection (SSTI) in the Bazar semantic template feature. An authenticated administrator can inject arbitrary Twig expressions into the bn_sem_template field, which are later executed server-side via Temp...

CVE-2026-52762 YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

GHSA-65P8-9433-JPCP YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

Summary YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig expressions into the Semantic template Twig field...

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

Summary YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig expressions into the Semantic template Twig field...

PT-2026-57025

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6 Description YesWiki Bazar contains a stored Server-Side Template Injection SSTI in the semantic template feature. SSTI occurs when an application embeds user-supplied input into a server-side template without...