CVE-2026-52777Critical· 9.4▾ MidnightYesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
9.4 → —
— → 9.4
9.4 → —
— → 9.4
9.4 → —
— → 9.4
9.4 → —
— → 9.4
9.4 → —
— → 9.4
9.4 → —
— → 9.4
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
yeswiki/yeswiki < 4.6.6Patched in:
yeswiki/yeswiki 4.6.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52762High· 7.1YesWiki is a wiki system written in PHP
CVE-2026-52763Medium· 6.5YesWiki is a wiki system written in PHP
CVE-2026-52766Critical· 9.1YesWiki is a wiki system written in PHP
CVE-2026-52767High· 8.2YesWiki is a wiki system written in PHP
CVE-2026-52769High· 8.3YesWiki is a wiki system written in PHP
CVE-2026-52770High· 7.5YesWiki is a wiki system written in PHP