YesWiki cross-site scripting vulnerability

Versions of YesWiki prior to 4.7.0 contain a cross-site scripting vulnerability. This vulnerability stems from a reflective XSS issue: attackers can inject JavaScript by providing query parameters matching the missing Bazar field name. The BazarField::getValue method then falls back to using the...