CVE-2026-116823

Versions of YesWiki prior to 4.7.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists because the BazarField::getValue() function falls back to unsanitized $_REQUEST values when Bazar field names are missing. These values are then rendered via Twig |raw templa...