EUVD-2026-110530

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue falls back to unsanitized $REQUEST values...

EUVD-2026-110531

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrerssites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing...

CVE-2026-116824

Versions of YesWiki prior to 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw in the handlers/page/referrers_sites.php component. The root cause is the failure to properly escape HTML metacharacters within the Referer header . This allows unauthenticated attackers to inject malici...