https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2013-5586.htmlhttps://patchthecve.com/cve/CVE-2013-5586.htmlTue, 16 Jun 2026 23:59:03 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in wikka.php in WikkaWiki before 1.3.4-p1 allows remote attackers to inject arbitrary web script or HTML via the wakka parameter to sql/.https://patchthecve.com/cve/CVE-2011-4452.htmlhttps://patchthecve.com/cve/CVE-2011-4452.htmlTue, 16 Jun 2026 23:34:54 +0000MEDIUM 6.8: Cross-site request forgery (CSRF) vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an {{image}} action.https://patchthecve.com/cve/CVE-2011-4451.htmlhttps://patchthecve.com/cve/CVE-2011-4451.htmlTue, 16 Jun 2026 23:34:54 +0000MEDIUM 4.3: libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP code to the spamlog_path file via the User-Agent HTTP header in an addcomment request. NOTE: the vendor disputes this issue because the rendering of the spamloghttps://patchthecve.com/cve/CVE-2011-4450.htmlhttps://patchthecve.com/cve/CVE-2011-4450.htmlTue, 16 Jun 2026 23:34:54 +0000MEDIUM 6.4: Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete arbitrary files via a non-initial .. (dot dot) in the file parameter, as demonstrated by the /../../wikka.config.php pathname in a download action.https://patchthecve.com/cve/CVE-2011-4449.htmlhttps://patchthecve.com/cve/CVE-2011-4449.htmlTue, 16 Jun 2026 23:34:54 +0000MEDIUM 6.8: actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a filhttps://patchthecve.com/cve/CVE-2011-4448.htmlhttps://patchthecve.com/cve/CVE-2011-4448.htmlTue, 16 Jun 2026 23:34:54 +0000HIGH 7.5: SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitrary SQL commands via the default_comment_display parameter in an update action.