Threats tagged 'ghsa-5rxq-hc4r-x8r8'

YesWiki versions prior to 4.7.0 have a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious JavaScript by manipulating query parameters that correspond to missing Bazar field names. The vulnerability arises because the application falls back to unsanitized user input rendered with Twig |raw templates, enabling execution of attacker-controlled scripts in the context of authenticated users.