CVE-2026-116824YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

Beschreibung

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-xcwg-2pj5-3qm4) vendor-advisory
• VulnCheck Advisory: YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler third-party-advisory