CVE-2026-105224
MEDIUM
NVD
CVSS Score
5.4
Severity
MEDIUM
Published
Oct 04, 2026
Vendor
unknown
Description
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.