CVE-2026-52771

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

CVE-2026-52762

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

CVE-2026-52777

CVE-2026-52777 affects YesWiki (a PHP wiki system) prior to version 4.6.6 . The vulnerability is an authenticated PHP object injection in BazarImportAction via an unrestricted unserialize() call in tools/bazar/services/CSVManager.php::importEntry(), which lacks the ['allowed_classes' => false]...

CVE-2026-52777 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

CVE-2026-52777 YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6...

CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52775 YesWiki Authenticated SQL Injection in ReactionManager

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. Th...

CVE-2026-52775

YesWiki (PHP wiki system) prior to version 4.6.6 is vulnerable to an authenticated SQL injection in ReactionManager::deleteUserReaction(). The {idreaction} and {id} URL path parameters are concatenated directly into a SQL LIKE clause without escaping, while a sibling code path correctly applies $...

CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

CVE-2026-52774

YesWiki (a PHP wiki system) is vulnerable to reflected XSS (CWE-79) in its Bazar widget handler prior to version 4.6.6. The id GET parameter is reflected into the data-formid and data-iframeUrl HTML attributes using only strip_tags(), which does not escape double quotes. An unauthenticated attack...

CVE-2026-52774 Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773 Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML ...

CVE-2026-52773

YesWiki (PHP wiki system), versions 4.1.0 through 4.6.5 , is vulnerable to a reflected XSS (CWE-79) in the archived-revision view. The time GET parameter is reflected unescaped into a hidden HTML input in handlers/page/show.php. Because MySQL coerces malformed DATETIME strings, an attacker append...

CVE-2026-52772 YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6...

CVE-2026-52772 YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6...

CVE-2026-52772

YesWiki prior to 4.6.6 is vulnerable to stored XSS in its Bazar form-field templates. Twig's |raw('html') filter suppresses auto-escaping of field.label and field.hint in attribute and label-body contexts across at least seven templates. The base layout layouts/input.twig is inherited by every fi...

CVE-2026-52771 YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

CVE-2026-52771 YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

CVE-2026-52771

YesWiki (PHP wiki system) versions 4.2.0 through 4.6.5 are affected by a second-order SQL injection in ApiController::deletePage(). A page tag containing a single quote is stored intact during insertion (the INSERT escapes it for SQL, but the raw byte persists), then read back unescaped into DELE...