CVE-2025-46350
Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting
Vexday Risk Score
8Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 3.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
29 Apr 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected products
YesWiki · yeswikiWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →