🚨 CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
GitHub
ActivityPub inbox does not bind the verified signer to the activity actor, allowing cross-actor delete and update
## Summary
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
🚨 CVE-2026-104447
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
GitHub
CSRF: arbitrary installed-package/extension deletion via GET in autoupdate UpdateAction
## Summary
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
🚨 CVE-2026-104448
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
GitHub
CSRF arbitrary page deletion via GET in ajaxdeletepage handler
## Summary
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
🚨 CVE-2026-104449
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
GitHub
Unauthenticated arbitrary page overwrite via Bazar entry creation with attacker-controlled id_fiche
## Summary
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
🚨 CVE-2026-104450
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
GitHub
Unauthenticated ACL-bypassing arbitrary page write and stored XSS via pointimage action
## Summary
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
🚨 CVE-2026-104451
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
GitHub
CSRF: page-revision restore (content overwrite) via GET in RevisionsHandler
## Summary
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
🚨 CVE-2026-104452
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
GitHub
CSRF: page attachment deletion/purge via GET in filemanager handler
## Summary
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
🚨 CVE-2026-104453
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
GitHub
CSRF: bulk tag-triple deletion via GET in admintag action
## Summary
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
🚨 CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
GitHub
Unauthenticated CPU-exhaustion DoS via O(n^2) regex in core wiki formatter (edit-preview)
## Summary
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
🚨 CVE-2026-104455
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
GitHub
Unauthenticated read-ACL bypass leaks page body excerpts via recentchangesrssplus RSS
## Summary
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
🚨 CVE-2026-104456
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
GitHub
Second-order SQL injection in AclService::updateRequestWithACL via unescaped username in read-ACL LIKE clause
## Summary
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
🚨 CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
GitHub
SQL injection in filtertags action via unescaped filterN parameter (backslash-escape breakout)
## Summary
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...
🚨 CVE-2026-104458
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
🎖@cveNotify
GitHub
SSRF guard bypass via IPv6 6to4 / NAT64 / IPv4-compatible transition wrappers of internal IPs (incomplete fix of the Signature.keyId…
## Summary
The `validateKeyIdUrl()` SSRF guard added to `HttpSignatureService::verifySignature()` blocks raw internal IPs and IPv4-mapped IPv6 (`::ffff:a.b.c.d`), but does not reject three other I...
The `validateKeyIdUrl()` SSRF guard added to `HttpSignatureService::verifySignature()` blocks raw internal IPs and IPv4-mapped IPv6 (`::ffff:a.b.c.d`), but does not reject three other I...
🚨 CVE-2026-104459
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
🎖@cveNotify
GitHub
SSRF via ActivityPub WebFinger handle resolution (actor_handle) - internal HTTPS reachability
## Summary
The ActivityPub WebFinger resolver builds a `.well-known/webfinger` URL from an attacker-supplied handle and fetches it server-side without ACL check or host/IP validation, yielding an S...
The ActivityPub WebFinger resolver builds a `.well-known/webfinger` URL from an attacker-supplied handle and fetches it server-side without ACL check or host/IP validation, yielding an S...
🚨 CVE-2026-104460
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
🎖@cveNotify
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
🎖@cveNotify
GitHub
Unauthenticated blind SQL injection in YesWiki `{{newtextsearch}}` via unescaped Bazar list option id
### Summary
YesWiki's `{{newtextsearch}}` search action contains an unauthenticated, blind SQL injection that lets any anonymous visitor read arbitrary attacker-chosen data from the database (...
YesWiki's `{{newtextsearch}}` search action contains an unauthenticated, blind SQL injection that lets any anonymous visitor read arbitrary attacker-chosen data from the database (...
🚨 CVE-2026-104461
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise.
🎖@cveNotify
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise.
🎖@cveNotify
GitHub
Stored XSS via unsanitized SVG upload in Bazar FileField (sanitization bypass)
## Summary
Bazar's `FileField` accepts file uploads on entry create/update and validates only the **extension** against the `authorized-extensions` allowlist — which **includes `svg`**. Un...
Bazar's `FileField` accepts file uploads on entry create/update and validates only the **extension** against the `authorized-extensions` allowlist — which **includes `svg`**. Un...
🚨 CVE-2026-104462
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
🎖@cveNotify
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
🎖@cveNotify
GitHub
SQL injection in nuagetag action via unescaped tags parameter (backslash-escape breakout)
## Summary
The Bazar `nuagetag` action concatenates the unescaped `tags` attribute into a raw SQL `... value IN (...)` clause. On MySQL running with the default `sql_mode` (backslash-escapes enable...
The Bazar `nuagetag` action concatenates the unescaped `tags` attribute into a raw SQL `... value IN (...)` clause. On MySQL running with the default `sql_mode` (backslash-escapes enable...
🚨 CVE-2026-104463
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
🎖@cveNotify
GitHub
Unauthenticated SSRF via public ActivityPub inbox (body actor/to never validated)
## Summary
The public ActivityPub inbox route accepts a signed `Follow` activity whose JSON body `actor`/`to` fields are never validated, then performs server-side GET and POST requests to those at...
The public ActivityPub inbox route accepts a signed `Follow` activity whose JSON body `actor`/`to` fields are never validated, then performs server-side GET and POST requests to those at...
🚨 CVE-2026-104464
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.
🎖@cveNotify
GitHub
SSRF via ActivityPub actor sync (abonnements&action=sync) - unvalidated actor URL
## Summary
The Bazar `abonnements` action's `sync` branch passes a raw, attacker-controlled `actor` URL straight to server-side HTTP fetches with no ACL check and no URL/scheme/IP validation, y...
The Bazar `abonnements` action's `sync` branch passes a raw, attacker-controlled `actor` URL straight to server-side HTTP fetches with no ACL check and no URL/scheme/IP validation, y...
🚨 CVE-2026-104465
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.
🎖@cveNotify
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.
🎖@cveNotify
GitHub
Reflected XSS (Unauthenticated) in YesWiki v4.6.6 ("Field" Parameter at ?ValentinDouarre)
### Summary
A Reflected Cross-Site Scripting (XSS) vulnerability was identified on the YesWiki application in the field parameter. The application improperly reflects unsanitized user input into...
A Reflected Cross-Site Scripting (XSS) vulnerability was identified on the YesWiki application in the field parameter. The application improperly reflects unsanitized user input into...
🚨 CVE-2026-104466
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.
🎖@cveNotify
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.
🎖@cveNotify
GitHub
YesWiki Wakka markdown image rendering allows stored XSS through unescaped src attribute
### Summary
The Wakka formatter's markdown image compatibility path inserts the image `src` value into a double-quoted HTML attribute without escaping or URL validation. A user who can edit pa...
The Wakka formatter's markdown image compatibility path inserts the image `src` value into a double-quoted HTML attribute without escaping or URL validation. A user who can edit pa...