CVE-2025-31131

CVE-2025-31131 - Explotación de Path Traversal en YesWiki 4.5.2 Este es un exploit de path traversal no autenticado dirigido a versiones de YesWiki anteriores a la 4.5.2. La vulnerabilidad existe en el parámetro squelette, que permite leer archivos arbitrarios del servidor. Detalles de la...

YesWiki < 4.6.4 - Unauthenticated SQL Injection

YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bnidnature parameter in FormManager::create is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read th...

YesWiki Archived Revision - Cross-Site Scripting

YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append an XSS payload after a valid revision timestamp. id: CVE-2026-52773 info: name: YesWiki...

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

YesWiki < 4.5.4 - Cross-Site Scripting

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. id: CVE-2025-46550 info: name: YesWiki 4.5.4 - Cross-Site Scripting author:...

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

CVE-2026-52774-YESWIKI-XSS

CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 es una vulnerabilidad XSS reflejado en el manejador de widgets Bazar de YesWiki. El parámetro de consulta en el endpoint NoSuchPage/widget está sanitizado de forma inadecuada mediante striptags, que no escapa las comillas dobles. Esto permite a un atacant...

CVE-2026-105224

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZfichetitre markup...

CVE-2026-105224 YesWiki before 4.6.7 Stored XSS via Bazar valeur Action

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZfichetitre markup...

CVE-2026-105224

YesWiki versions prior to 4.6.7 are vulnerable to a cross-site scripting (XSS) vulnerability within the Bazar valeur action . The root cause is the rendering of unescaped HTML fetched from a remote URL. Specifically, an attacker can point the tools/bazar/actions/valeur.php endpoint to a controlle...

CVE-2026-105224 YesWiki before 4.6.7 Stored XSS via Bazar valeur Action

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZfichetitre markup...

EUVD-2026-92111

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZfichetitre markup...

Blackash-CVE-2025-31131

Blackash-CVE-2025-31131 CVE-2025-31131 - YesWiki 4.5.2 路径遍历漏洞利用 描述 YesWiki 是一个用 PHP 编写的 wiki 系统。squelette 参数存在路径遍历攻击漏洞，使攻击者能够读取服务器上的任意文件。此漏洞已在 4.5.2 版本中修复。 NIST: NVD 基础评分: 7.5 🔴 高危 向量: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CNA: GitHub, Inc 基础评分: 8.6 🔴 高危 向量:...

Yeswiki < 4.5.2 - Unauthenticated Path Traversal

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. id: CVE-2025-31131 info: name: Yeswiki 4.5.2 - Unauthenticated Path Traversal author: iamnoooob,rootxharsh,pdresearch severity: high...

PT-2026-104643

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ fiche titre markup...

CVE-2026-104472

YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from...

CVE-2026-104471

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved...

CVE-2026-104467

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

CVE-2026-104470

YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services...

CVE-2026-104468

YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password throug...