Reflected Cross-Site Scripting Vulnerability in YesWiki Product

CVE-2026-104465

What is CVE-2026-104465?

YesWiki before version 4.6.7 is susceptible to a reflected cross-site scripting vulnerability. This issue allows unauthenticated attackers to inject malicious scripts through the 'field' parameter of the mail handler. By crafting specially designed links, attackers can manipulate the field value to escape the ajax-mail-form action attribute, enabling the execution of JavaScript code in the browsers of unsuspecting victims. As a result, this vulnerability poses a significant risk, potentially leading to unauthorized access or actions performed under the identity of the victim.

References