CVE-2025-46550
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Vexday Risk Score
28Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 4.3EPSS 0.5%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
29 Apr 2025Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
YesWiki · yeswikiWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →