Most recent entries from all

EUVD-2026-215260

2026-10-22T00:18:53.533200+00:00

EUVD-2026-215260

fkie_cve-2025-24017

2026-10-22T00:18:53.533232+00:00

YesWiki is a wiki system written in PHP. Versions up to and including 4.4.5 are vulnerable to any end-user crafting a DOM based XSS on all of YesWiki's pages which is triggered when a user clicks on a malicious link. The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked. This vulnerability allows any user to generate a malicious link that will trigger an account takeover when clicked, therefore allowing a user to steal other accounts, modify pages, comments, permissions, extract user data (emails), thus impacting the integrity, availability and confidentiality of a YesWiki instance. Version 4.5.0 contains a patch for the issue.

GHSA-wphc-5f2j-jhvg — Unauthenticated DOM Based XSS in YesWiki

2026-10-22T00:18:53.533267+00:00

Affected: Packagist: yeswiki/yeswiki

# Unauthenticated DOM Based XSS in YesWiki <= 4.4.5

### Summary It is possible for any end-user to craft a DOM based XSS on all of YesWiki's pages which will be triggered when a user clicks on a malicious link.

This Proof of Concept has been performed using the followings: - YesWiki v4.4.5 (`doryphore-dev` branch, latest) - Docker environnment (`docker/docker-compose.yml`) - Docker v27.5.0 - Default installation

### Details The vulnerability makes use of the search by tag feature. When a tag doesn't exist, the tag is reflected on the page and isn't properly sanitized on the server side which allows a malicious user to generate a link that will trigger an XSS on the client's side when clicked.

This part of the code is managed by `tools/tags/handlers/page/listpages.php`, and **[this piece of code](https://github.com/YesWiki/yeswiki/blob/doryphore-dev/tools/tags/handlers/page/listpages.php#L84)** is responsible for the vulnerability:

```php $output .= '

' . "\n"; if ($nb_total > 1) { $output .= _t('TAGS_TOTAL_NB_PAGES', ['nb_total' => $nb_total]); } elseif ($nb_total == 1) { $output .= _t('TAGS_ONE_PAGE_FOUND'); } else { $output .= _t('TAGS_NO_PAGE'); } $output .= (!empty($tab_selected_tags) ? ' ' . _t('TAGS_WITH_KEYWORD') . ' ' . implode(' ' . _t('TAGS_WITH_KEYWORD_SEPARATOR') . ' ', array_map(function ($tagName) { return '' . $tagName . ''; }, $tab_selected_tags)) : '') . '.'; $…