VulnSocial

CVE-2026-34598Disclosure(yeswiki / yeswiki)

LOWCVSS 6.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch yeswiki yeswiki systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.

yeswiki CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-79CWE-87

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • yeswiki

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
yeswiki
Products
yeswiki

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-03: 1Patch / Workaround · 2026-04-03: 1Technical Details · 2026-04-03: 104-03
Signal classification1 categories
Disclosure
1100.0%
Referenced assets2 URLs
Full discourse1 post
  • Khokamoni@kh0kamoni
    Disclosure

    CVE-2026-34598 (Published) Severity- High, Reference: https://www.cve.org/CVERecord?id=CVE-2026-34598 Year ago, I reported (Persistent Blind XSS), a security vulnerability to YesWiki. The bug is now fixed and the report is disclosed publicly. Disclosed report: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-37fq-47qj-6j5j

    Post summary

    The post announces CVE-2026-34598 as a Persistent Blind XSS in YesWiki, notes that the flaw has been fixed, and references a public GitHub advisory.

    0001034
    1 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appyeswikiyeswiki---

Explore more

Back to dashboardyeswiki CVEsyeswiki vulnerabilities