YesWiki's archived-revision view reflects the "time" "GET" parameter into a hidden HTML input in "handlers/page/show.php" without escaping. Because MySQL coerces malformed "DATETIME" strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archived revision, and execute arbitrary JavaScript in the victim's browser. The vulnerable form is only rendered when the victim can both read and edit the target page. In restricted deployments this requires a victim with "read" and "write" access to that page. On a default "doryphore 4.6.5" install, public pages such as "PagePrincipale" were editable anonymously during validation, so the issue can also affect unauthenticated visitors in that configuration.