CVE-2026-104473CWE-79cross-site-scripting

CVE-2026-104473

Medium · published October 2, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-02T16:17Z
References (3)
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq · [email protected]https://www.vulncheck.com/advisories/yeswiki-before-4.5.3-multiple-reflected-xss-via-bazar-and-listpages · [email protected]https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 04 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 02 OCT 11:38Z
    YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
    cvelistv5