CVE-2026-116206 in YesWiki
요약
\~에 의해 MITRE • 2026. 10. 25.
YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.