CVE-2026-34598
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Apr 02, 2026
Vendor
unknown
Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.