CVE-2026-104473

Medium

Description

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

SeverityMedium

CVSS6.1

Exploit probability—

ProductYeswiki/yeswiki

PublishedOct 2, 2026

First seenOct 2, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

yeswiki/yeswiki4.6.0 or later

Vendor advisories

github.com/YesWiki/yeswiki/security/advisories/GHSA-5724-x3rh-5qqq

Affected products

Product	Affected versions	Fixed in
yeswiki/yeswikiPackagist	v < 4.6.0	4.6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.