The vulnerability allows a reflected cross‑site scripting exploit by inserting malicious HTML or JavaScript into the ‘time’ GET parameter of the archived‑revision view. Because MySQL coerces malformed DATETIME strings, an attacker can append payloads to a valid timestamp, cause the page to load that archived revision, and execute arbitrary script in the context of any visitor who has both read and edit access to the page. The attack can also reach unauthenticated users on installations that permit anonymous editing of public pages, thereby enabling the exploitation in broader environments.

YesWiki versions from 4.1.0 up to but not including 4.6.6 are affected. The vulnerability exists in the default ‘handlers/page/show.php’ of those releases. Administrators of SayWiki installations—particularly those with the default doryphore 4.6.5 configuration that allows anonymous edits of pages such as PagePrincipale—must verify their version and apply any necessary updates.

The CVSS score of 6.1 indicates a moderate risk level. EPSS is not available, so the projected exploitation probability is unknown, and the issue is not listed in CISA’s KEV catalog, implying no widely known exploits so far. Nevertheless, the attacker only needs to craft a timestamp and the victim must be able to view and edit the target page, a condition that can be satisfied in many typical deployments. Given these prerequisites, the vulnerability poses a tangible threat when the attack surface is open.