Medium severity5.4NVD Advisory· Published Oct 4, 2026· Updated Oct 4, 2026
CVE-2026-105224
CVE-2026-105224
Description
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.