CVE-2026-46670

YesWiki

CVE-2026-46670 YesWiki: Unauthenticated SQL Injection

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...

CVE-2026-46670 YesWiki: Unauthenticated SQL Injection

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...

CVE-2026-52762

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:30+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp...

CVE-2026-52763

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:28+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89v6-j5x6-cmj3...

CVE-2026-52767

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:23+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-mv28-wj57-f57g 2026-09-05 04:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muqlr5bgtt2k 2026-09-08...

CVE-2026-52769

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:21+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-vw42-752g-5mrp 2026-09-05 06:02:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muqskl3epj2m 2026-09-08...

CVE-2026-52770

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:19+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qg78-vmvc-fhjw 2026-09-05 06:02:34+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muqskrwigk22 2026-09-08...

CVE-2026-52771

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:16+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-8f2v-2qhj-gfwg 2026-09-05 06:02:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muqsldu7st22 2026-09-07...

CVE-2026-52772

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:14+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-xc7j-3g8q-9vh4...

CVE-2026-52773

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:12+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-35f3-pg38-486f...

CVE-2026-52774

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:10+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-r5xw-gcgw-hwp5 2026-07-13 06:00:05+00:00| confirmed|...

CVE-2026-52775

creationtimestamp| type| source ---|---|--- 2026-07-09 22:35:07+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4pf7-cc4r-g63h 2026-09-05 04:00:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muqlqpyeco2p 2026-09-09...

EUVD-2026-35181

YesWiki has Unsafe eval in its Formula Calculato, Leading to Remote Code Execution & Denial of Service...

GHSA-4PF7-CC4R-G63H YesWiki has Authenticated SQL Injection via ReactionManager

Summary YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. The parameters are concatenated directly into a SQL LIKE...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the deleteUserReaction process. An attacker can access and manipulate sensitive database information by injecting crafted SQL through the idreaction and id URL path parameters as an authenticated user. Remediation...

YesWiki has Authenticated SQL Injection via ReactionManager

Summary YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction that allows any authenticated user to inject arbitrary SQL via the idreaction and id URL path parameters. The parameters are concatenated directly into a SQL LIKE...

YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

Summary YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the...

GHSA-R5XW-GCGW-HWP5 YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

Summary YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the...

YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`

Summary YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archive...