CVE-2026-104473

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-104473

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104473.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-104473

Aliases

GHSA-5724-x3rh-5qqq

Published

2026-10-02T11:38:37Z

Modified

2026-10-03T03:46:56Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages

Details

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104473.json"
}

References

Affected packages

Git / github.com/yeswiki/yeswiki

Affected ranges

Type

GIT

Repo

https://github.com/yeswiki/yeswiki

Events

Introduced

Fixed

6894234bbde6ab168bf4253f9a581bd24bf53766

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.5.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v4.*

v4.1.0

v4.1.5

v4.2.0

v4.2.1

v4.2.2

v4.3.0

v4.3.1

v4.4.0

v4.4.1

v4.4.2

v4.4.3

v4.5.1

v4.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104473.json"