MEDIUM 5.3 NVD
CVE-2026-116823
YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query param
YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() falls back to unsanitized $_REQUEST values rendered via Twig |raw templates, performing same-origin authenticated actions in victims' sessions.
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hcvp-q8fx-84mc
- https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-reflected-xss-via-bazarfield-req
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-27 via NVD.
vulnfeed aggregates 18513 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.