YesWiki Vulnerable to Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes

CVE-2026-52774

### Summary YesWiki's Bazar widget handler reflects the `id` `GET` parameter into HTML attributes using `strip_tags()` o

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki Vulnerable to Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php`

CVE-2026-52773

### Summary YesWiki's archived-revision view reflects the `time` `GET` parameter into a hidden HTML input in `handlers/p

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))

CVE-2026-52772

# Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body cont

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

CVE-2026-52771

## Summary `ApiController::deletePage()` interpolates a page tag retrieved from the database into a `DELETE FROM …_links

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters

CVE-2026-52770

### Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric `query`

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

CVE-2026-52769

## Summary The `POST /api/forms/{formId}/actor/inbox` route - exposed publicly with `acl:"public"` - accepts an HTTP `Si

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

CVE-2026-52767

## Summary `HttpSignatureService::verifySignature()` checks the result of PHP's `openssl_verify()` with a **loose boolea

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

CVE-2026-52766

### Summary The `{{erasespamedcomments}}` wiki action (`actions/EraseSpamedCommentsAction.php`) accepts a `suppr[]` arr

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

CVE-2026-52763

### Summary The `recentchanges` action (`actions/recentchanges.php`) accepts a `period` argument from two disjoint para

历史摘要 · 未重新核验 · GitHub Advisory

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

CVE-2026-52762

### Summary YesWiki Bazar contains a stored Server-Side Template Injection (`SSTI`) vulnerability in the semantic templa

历史摘要 · 未重新核验 · GitHub Advisory

laravel-backup-restore has an OS Command Injection during database restore

CVE-2026-53932

## Summary A crafted backup archive can trigger OS command injection during database restore. The restore workflow extra

历史摘要 · 未重新核验 · GitHub Advisory

Sharp Missing Authorization Check in Quick Creation Command Endpoints

CVE-2026-53634

### Impact The create and store endpoints of the Quick Creation Command feature did not enforce any authorization check.

历史摘要 · 未重新核验 · GitHub Advisory

Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection

## Impact `Webauthn\SimpleFakeCredentialGenerator` is the library-provided default implementation of the `FakeCredentia

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

CVE-2026-55794

### Requirements: * Control panel access * Permissions to edit an entry ### Details Control panel users with the abil

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS: Stored XSS via Structure entry title in table view

CVE-2026-55793

# Stored XSS via Structure entry title in table view ## Summary An Author-level control panel user can store a JavaScr

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS: Sensitive File Disclosure / Server-Side File Read

CVE-2026-55792

The `dataUrl()` Twig function is included in Craft’s Twig sandbox allowlist, allowing any control panel user granted the

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

CVE-2026-55790

## Summary An attacker with only a GitHub account can plant a JavaScript payload in a `craftcms/cms` issue title. When

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

### Summary A user with Control Panel access but without permission to view a target private asset can call `assets/pre

历史摘要 · 未重新核验 · GitHub Advisory

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

CVE-2026-49284

## Summary SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login. If a saved SP

历史摘要 · 未重新核验 · GitHub Advisory

Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation

### Summary Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timeshee

历史摘要 · 未重新核验 · GitHub Advisory