CVE-2026-116824YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

Açıklama

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-xcwg-2pj5-3qm4) vendor-advisory
• VulnCheck Advisory: YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler third-party-advisory