YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.
CVE-2026-104473
Primary source · Revision 2
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104473
yeswiki
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "YesWiki",
"product": "yeswiki",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "4.5.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.5.3",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/yeswiki/yeswiki",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-104473
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #72836 · Revision 2
- Added to Heist Feed
- Publisher date