Live › vulnerability › CVE-2026-116823
Go to dashboardYesWiki before 4.7.0 reflects unsanitized request parameters into pages through Bazar field handling and Twig raw output. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's session and perform actions as that user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Sites running YesWiki versions before 4.7.0 that render Bazar fields are affected. The sources do not say whether every installation is exposed or only those using specific Bazar forms, so the exact exposure is unknown.
No product ranges from the sources yet.
4.7.0 are affected.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() falls back to unsanitized $_REQUEST values rendered via Twig |raw templates, performing same-origin authenticated actions in victims' sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116823")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.