Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
86 results · page 2 of 2
Oct 2, 2026YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hostsCVE-2026-104441 · Other software · YesWiki · reported by VulnCheckMedium 6.9
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests viaCVE-2026-104440 · Other software · YesWiki · reported by VulnCheckMedium 6.9
YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addreCVE-2026-104439 · Other software · YesWiki · reported by VulnCheckHigh 7.1
YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm registered email addresses through differing responses. Attackers can submit emails to the MotDePassePerdu recovery page without rate limiting to identify valid accounts for targeted phishing or password-spraying.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages withoutCVE-2026-104438 · Other software · YesWiki · reported by VulnCheckHigh 8.7
YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can embed these actions with a chosen tag or page name to disclose the names and body-derived titles of ACL-restricted pages.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52777 · Other software · YesWiki · reported by GitHubCritical 9.4
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52775 · Other software · YesWiki · reported by GitHubHigh 8.8
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52774 · Other software · YesWiki · reported by GitHubMedium 6.1
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication. During validation, the vulnerable widget route returned the injected HTML for both /HomePage/widget?id=... and /NoSuchPage/widget?id=..., which shows that no login, no page ownership, no edit rights, and not even a valid page tag were required. The only routing prerequisite observed was that the Bazar extension is enabled and the request includes an id parameter. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52773 · Other software · YesWiki · reported by GitHubMedium 6.1
YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archived revision, and execute arbitrary JavaScript in the victim's browser. The vulnerable form is only rendered when the victim can both read and edit the target page. In restricted deployments this requires a victim with read and write access to that page. On a default doryphore 4.6.5 install, public pages such as PagePrincipale were editable anonymously during validation, so the issue can also affect unauthenticated visitors in that configuration. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52772 · Other software · YesWiki · reported by GitHubMedium 5.5
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52771 · Other software · YesWiki · reported by GitHubHigh 8.3
YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard {{include page="…"}} link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52770 · Other software · YesWiki · reported by GitHubHigh 7.5
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validation. An unauthenticated attacker can inject boolean SQL expressions and infer database contents from whether entries are returned. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52769 · Other software · YesWiki · reported by GitHubHigh 8.3
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature() parses the header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification or URL validation. An unauthenticated remote attacker can therefore make YesWiki issue arbitrary outbound HTTP requests to any host the server can reach - internal services, cloud-metadata endpoints (169.254.169.254), intranet-only admin panels, etc. - and read enough back via timing and error-message oracles to scan ports, enumerate services, and (on a real cloud instance) reach IAM metadata. The only deployment-side precondition is that ActivityPub be enabled on at least one Bazar form. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52767 · Other software · YesWiki · reported by GitHubHigh 8.2
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a loose boolean negation - if (!openssl_verify(...)) { throw ... }. PHP's openssl_verify has four possible return values: 1, 0, -1, and "false". The -1 row is the bypass: PHP's truthiness rules make -1 a truthy value, so !(-1) === false, the throw is skipped, and the controller proceeds to processActivity(). Any condition that makes OpenSSL's EVP_VerifyFinal() return -1 triggers the bypass. The reachable consequence is the controller silently treats a failed verification as success and processes the attacker's payload. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52766 · Other software · YesWiki · reported by GitHubCritical 9.1
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52763 · Other software · YesWiki · reported by GitHubMedium 6.5
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page. On a default install (default_write_acl='*'), this includes anonymous users, subject to the hashcash JS check on the page-edit form. Once the trigger page is saved, every subsequent view fires the injection as the SQLi is stored. Stored SQL injection is reachable through the page-edit flow, with arbitrary database read. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026YesWiki is a wiki system written in PHP.CVE-2026-52762 · Other software · YesWiki · reported by GitHubHigh 7.1
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026YesWiki is a wiki system written in PHP.CVE-2026-46670 · Other software · YesWiki · reported by GitHubCritical 9.8
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026YesWiki is a wiki system written in PHP.CVE-2026-52778 · Other software · YesWiki · reported by GitHubCritical 9.8
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution. Version 4.6.6 patches the issue.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026YesWiki is a wiki system written in PHP.CVE-2026-41143 · Other software · YesWiki · reported by GitHubHigh 8.8
YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data['id_fiche'] value (sourced from $_POST['id_fiche']) is concatenated directly into a raw SQL query without any sanitization or parameterization. This issue has been patched in version 4.6.1.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2026YesWiki is a wiki system written in PHP.CVE-2026-34598 · Other software · YesWiki · reported by GitHubHigh 7.1
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots fCVE-2025-52277 · Other software · Yeswiki · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in YesWiki v.4.54 allows a remote attacker to execute arbitrary code via a crafted payload to the meta configuration robots field
- Product
- Yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46550 · Other software · YesWiki · reported by GitHubMedium 4.3
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46549 · Other software · YesWiki · reported by GitHubMedium 4.3
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46348 · Other software · YesWiki · reported by GitHubCritical 10
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46350 · Other software · YesWiki · reported by GitHubLow 3.5
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46349 · Other software · YesWiki · reported by GitHubHigh 7.6
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46347 · Other software · YesWiki · reported by GitHubMedium 5.8
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a file with a PHP extension, which then can be browsed to in order to execute arbitrary code on the server, resulting in a full compromise of the server. This could potentially be performed unwittingly by a user. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2025YesWiki is a wiki system written in PHP.CVE-2025-46346 · Other software · YesWiki · reported by GitHubMedium 6.3
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user viewing the affected comment. The XSS occurs because the application fails to properly sanitize or encode user input submitted to the comments. Notably, the application sanitizes or does not allow execution of `<script>` tags, but does not account for payloads obfuscated using JavaScript block comments like `/* JavaScriptPayload */`. This issue has been patched in version 4.5.4.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025YesWiki is a wiki system written in PHP.CVE-2025-31131 · Other software · YesWiki · reported by GitHubHigh 8.6
YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025YesWiki is a wiki system written in PHP.CVE-2025-24019 · Other software · YesWiki · reported by GitHubHigh 7.1
YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without any limitation on the filesystem's scope. This vulnerability allows any authenticated user to arbitrarily remove content from the Wiki resulting in partial loss of data and defacement/deterioration of the website. In the context of a container installation of YesWiki without any modification, the `yeswiki` files (for example .php) are not owned by the same user (root) as the one running the FPM process (www-data). However in a standard installation, www-data may also be the owner of the PHP files, allowing a malicious user to completely cut the access to the wiki by deleting all important PHP files (like index.php or core files of YesWiki). Version 4.5.0 contains a patch for this issue.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025YesWiki is a wiki system written in PHP.CVE-2025-24018 · Other software · YesWiki · reported by GitHubHigh 7.6
YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the content edition feature and more specifically of the `{{attach}}` component allowing users to attach files/medias to a page. When a file is attached using the `{{attach}}` component, if the resource contained in the `file` attribute doesn't exist, then the server will generate a file upload button containing the filename. This vulnerability allows any malicious authenticated user that has the right to create a comment or edit a page to be able to steal accounts and therefore modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025YesWiki is a wiki system written in PHP.CVE-2025-24017 · Other software · YesWiki · reported by GitHubHigh 7.6
YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024YesWiki is a wiki system written in PHP.CVE-2024-51478 · Other software · YesWiki · reported by GitHubCritical 9.9
YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.CVE-2021-43091 · Other software · Yeswiki · reported by MITREHigh 7.5
An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.
- Product
- Yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2019SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to execute arbitrary SQL commands via the "idCVE-2018-13045 · Other software · Yeswiki · reported by MITRECritical 9.8
SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to execute arbitrary SQL commands via the "id" parameter.
- Product
- Cercopitheque
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Aug 20, 2018YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result inCVE-2018-1000641 · Other software · Yeswiki · reported by MITRECritical 9.8
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code, disclosure of information.
- Product
- Yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.