CVE-2026-104473: YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.
Affected Software
Event History
Frequently Asked Questions
Who can be targeted by this issue?
Both authenticated and unauthenticated users can be targeted if they are persuaded to open a crafted link. The impact can include session hijacking and actions performed through backend functionality in the context of an authenticated victim.
What does an attacker need to exploit it?
The attacker can exploit the issue remotely with low complexity and no privileges, but requires user interaction: a victim must open a crafted URL. The affected inputs include incomingurl, id, file, tags, and template.
Which YesWiki versions are affected?
YesWiki versions before 4.5.3 are affected. The provided information does not identify a specific configuration prerequisite.