Sign in
Deutsch English Español Polski
Medium

YesWiki Cross Site Scripting vulnerability

  • Disclosed: 09.09.2025
  • Updated: 11.10.2026 10:22

Cross Site Scripting vulnerability in YesWiki v.4.5.4 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package yeswiki/yeswiki <= 4.5.4 no fix

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
yeswiki/yeswiki
Disclosed
09.09.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-29cj-cxw4-v4j2 - CC BY 4.0

Vulnerability history: yeswiki/yeswiki

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
03.2022 07.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 16
  • Medium 8
  • Low 2

Disclosures per year

Severity:
  1. YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
    Critical · 9.8 CVE-2026-52778 < 4.6.6 4.6.6
  2. YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
    Critical CVE-2026-52777 < 4.6.6 4.6.6
  3. YesWiki has Authenticated SQL Injection via ReactionManager
    High · 8.8 CVE-2026-52775 < 4.6.6 4.6.6
  4. YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
    High · 8.3 CVE-2026-52771 >= 4.2.0, < 4.6.6 4.6.6
  5. YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
    High · 7.5 CVE-2026-52770 < 4.6.6 4.6.6
  6. YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
    High · 8.3 CVE-2026-52769 >= 4.6.2, < 4.6.6 4.6.6
  7. YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
    High · 8.2 CVE-2026-52767 >= 4.6.2, < 4.6.6 4.6.6
  8. YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
    Critical · 9.1 CVE-2026-52766 < 4.6.6 4.6.6
  9. YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
    High CVE-2026-52762 < 4.6.6 4.6.6
  10. YesWiki: Unauthenticated SQL Injection
    Critical · 9.8 CVE-2026-46670 < 4.6.4 4.6.4
  11. YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
    High · 8.8 CVE-2026-41143 < 4.6.1 4.6.1
  12. YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"
    High CVE-2026-34598 < 4.6.0 4.6.0
  13. YesWiki Cross Site Scripting vulnerability this entry
    Medium · 6.1 CVE-2025-52277 <= 4.5.4 no fix
  14. YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
    High CVE-2025-46347 < 4.5.4 4.5.4
  15. YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
    Critical · 10.0 CVE-2025-46348 < 4.5.4 4.5.4
  16. YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
    High · 7.6 CVE-2025-46349 <= 4.5.3 no fix
  17. Yeswiki Path Traversal vulnerability allows arbitrary read of files
    High · 8.6 CVE-2025-31131 < 4.5.2 4.5.2
  18. Authenticated arbitrary file deletion in YesWiki
    High · 7.1 CVE-2025-24019 < 4.5.0 4.5.0
  19. Authenticated Stored XSS in YesWiki
    High · 7.6 CVE-2025-24018 < 4.5.0 4.5.0
  20. Unauthenticated DOM Based XSS in YesWiki
    High · 7.6 CVE-2025-24017 < 4.5.0 4.5.0
Show more (2) Showing 20 of 22

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.