Live › vulnerability › CVE-2026-116824
Go to dashboardYesWiki before 4.7.0 stores the hostname from a crafted Referer header and renders it unescaped on the referrer-sites page. An unauthenticated attacker can run JavaScript in the browser of any user who opens that page, including logged-in administrators, and act with their same-origin rights.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Sites running YesWiki before 4.7.0 that have the referrer-sites page in use are exposed, since the payload is stored from ordinary incoming requests and shown to whoever views that page. Staff or admins who open that page while logged in carry the most risk. Installs already on 4.7.0 or later can skip it.
No product ranges from the sources yet.
4.7.0.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116824")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.