CVE-2026-105224 - YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
Brief
CVE ID : CVE-2026-105224
Published : Oct. 4, 2026, 4:16 p. m.
- 3 hours, 15 minutes ago
Description : YesWiki before 4.
- 7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur. php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.
Severity: 5.4
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...