CVE-2026-105224

Published 4 October 2026 · tracked since 4 October 2026

Description

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup wi

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105217 LOW 3.1
• CVE-2026-105219 HIGH 7.5
• CVE-2026-105089 HIGH 8.7
• CVE-2026-105215 CRITICAL 9.1
• CVE-2026-105158 HIGH 7.3
• CVE-2026-105156 LOW 3.7
• CVE-2026-105146 MEDIUM 4.7
• CVE-2026-105144 MEDIUM 5.3
• CVE-2026-105137 MEDIUM 5
• CVE-2026-86817

→ Open the live CVE board · all tools