CVE-2025-46349
HIGH NUCLEIYesWiki <4.5.4 - XSS
Title source: llmDescription
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.
Nuclei Templates (1)
YesWiki Reflected XSS via File Upload
HIGHby Mahmoud Gamal
Shodan:
html:"yeswiki"
FOFA:
body="yeswiki"
Scores
CVSS v3
7.6
EPSS
0.0054
EPSS Percentile
67.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Details
CWE
CWE-79
Status
published
Products (2)
yeswiki/yeswiki
< 4.5.4
yeswiki/yeswiki
0Packagist
Published
Apr 29, 2025
Tracked Since
Feb 18, 2026