CVE-2024-51478: critical vulnerability in yeswiki
Use of a Broken or Risky Cryptographic Algorithm in YesWiki
Published
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 0.4%
exploitation probability
0.4%top 71% of all CVEs
observed exploitation
nono source reports it
YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected products
YesWiki · yeswikiRelated CVEs — yeswiki
In the same product, most dangerous first.
CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.5%CVE-2026-46670CRITICALYesWiki: Unauthenticated SQL InjectionEPSS 2.0%CVE-2025-46347MEDIUMYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionEPSS 1.0%CVE-2026-52778CRITICALYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)EPSS 0.8%CVE-2026-52762HIGHYesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesEPSS 0.8%CVE-2026-52774MEDIUMReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiEPSS 0.7%