YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.
References
| Link | Resource |
|---|---|
| https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524 | Patch |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2 | Exploit Vendor Advisory |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2 | Exploit Vendor Advisory |
Configurations
History
09 May 2025, 13:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Yeswiki
Yeswiki yeswiki |
|
| CPE | cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:* | |
| References | () https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2 - Exploit, Vendor Advisory | |
| References | () https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
29 Apr 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-29 18:15
Updated : 2025-05-09 13:56
NVD link : CVE-2025-46349
Mitre link : CVE-2025-46349
JSON object : View
Products Affected
yeswiki
- yeswiki
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')