CVE-2026-116824

Versions of YesWiki prior to 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw in the handlers/page/referrers_sites.php component. The root cause is the failure to properly escape HTML metacharacters within the Referer header . This allows unauthenticated attackers to inject malici...