{"id":"CVE-2026-104450","published":"2026-10-02T12:17:16.483","lastModified":"2026-10-02T15:17:07.310","description":"YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7547-q56p-h99v","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-acl-bypass-and-stored-xss-via-pointimage-action","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-7547-q56p-h99v","tags":[]}],"hasPoc":true,"ai":null}