CVE-2025-46349

HIGHNuclei

YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-46349 has a selected CVSS score of 7.6 (high); EIP currently links 1 Nuclei template.

Description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 29, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

yeswiki

Browse YesWiki / yeswiki
CVE List< 4.5.4affected

yeswiki/yeswiki

Browse Packagist / yeswiki/yeswiki
GitHub AdvisoryThrough 4.5.3affected

Nuclei templates

1
ProjectDiscoveryHIGHYesWiki Reflected XSS via File UploadCVSS 6.1

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.

Remediation

Update to version 4.5.4 or later.

AuthorsMahmoud Gamal
Template tagscvecve2025xssyeswiki
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Shodan: html:"yeswiki"
FOFA: body="yeswiki"
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2 https://nvd.nist.gov/vuln/detail/CVE-2025-46349

Source: ProjectDiscovery

References

6