PT-2026-125529

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executin...