CVE-2026-34598

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34598
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34598.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34598
Aliases
Published
2026-04-02T17:37:37.386Z
Modified
2026-07-08T08:12:51.405460876Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"
Details

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34598.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-87"
    ]
}
References

Affected packages

Git / github.com/yeswiki/yeswiki

Affected ranges

Type
GIT
Repo
https://github.com/yeswiki/yeswiki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
fa94a53f810918f02a8da7138c066eee5dc68b0c
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.6.0"
        }
    ]
}

Affected versions

v4.*
v4.1.0
v4.1.5
v4.2.0
v4.2.1
v4.2.2
v4.3.0
v4.3.1
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.5.1
v4.5.2
v4.5.3
v4.5.4
v4.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34598.json"