CVE-2026-104473

6.1 MEDIUMpublic exploit available

Published 2026-10-02 · Updated 2026-10-08

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq

All references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq
https://www.vulncheck.com/advisories/yeswiki-before-4.5.3-multiple-reflected-xss-via-bazar-and-listpages
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2016-20098PoC
MEDIUMCVE-2023-54408PoC
UNSCOREDCVE-2023-5648
MEDIUMCVE-2024-31027
MEDIUMCVE-2024-34321
MEDIUMCVE-2024-58391PoC
MEDIUMCVE-2025-12828
MEDIUMCVE-2025-13533PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.