CVE-2026-104473

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

EUVD-2026-91396

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104473

Versions of YesWiki before 4.5.3 are susceptible to multiple reflected cross-site scripting (XSS) vulnerabilities. The root cause is the failure to sanitize several input parameters, specifically incomingurl , id , file , tags , and template . A remote attacker can leverage these flaws by luring ...

CVE-2026-104473: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

PT-2026-104283

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the incomingurl parameter. An attacker can manipulate the session of an authenticated user and potentially gain unauthorized access or modify the content of the web page by injecting malicious scripts. Note:...