p PatchFirst

CVE-2026-104473

CVE-2026-104473 · YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

This page contains facts from public vulnerability sources. Check the original advisory before updating.

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

CVSS 5.1 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • yeswiki

    Versions
    • ≥ 0, < 4.5.3: Affected (semver)
    • 4.5.3: Not affected (semver)

    Update to 4.5.3

  • yeswiki/yeswiki Packagist

    Versions
    • 4.2.3
    • v4.1.0
    • v4.1.1
    • v4.1.2
    • v4.1.3
    • v4.1.4
    • v4.1.5
    • v4.2.0
    • v4.2.1
    • v4.2.2
    • v4.2.4
    • v4.3
    • v4.3.1
    • v4.4.0
    • v4.4.1
    • v4.4.2
    • v4.4.3
    • v4.4.4
    • v4.4.5
    • v4.5.0
    • v4.5.1
    • v4.5.2
    • v4.5.3
    • v4.5.4
    • v4.5.5
    Affected ranges
    • ECOSYSTEM: < 4.6.0

    Update to 4.6.0

Original sources

Check your server →