Threats tagged 'ghsa-wh6h-5cwg-jvgh'

YesWiki versions prior to 4.7.0 have a stored cross-site scripting (XSS) vulnerability in the handlers/page/referrers_sites.php component. This flaw allows unauthenticated attackers to inject malicious scripts via specially crafted Referer headers. When a victim visits the referrer-sites page, the injected JavaScript executes in their browser context, enabling same-origin authenticated actions.