CVE-2026-104465: Yeswiki

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.

Affected products

• Yeswiki Yeswiki: before 4.6.7 (fixed in 4.6.7)

Published 2026-10-02. Last modified 2026-10-06.