QwikSec

Security Database

CVE

CWE

Training

CVE-2026-34598

Published: Apr 2, 2026

Modified: Apr 2, 2026

PUBLISHED

Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.

Vendor	Product	Versions
YesWiki	yeswiki	affected `< 4.6.0`

Weaknesses (CWE)

References

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-37fq-47qj-6j5j

x_refsource_CONFIRM

https://github.com/YesWiki/yeswiki/releases/tag/v4.6.0

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.