Reflected Cross-Site Scripting Vulnerability in YesWiki by YesWiki
CVE-2025-46350

4.8MEDIUM

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
29 April 2025

What is CVE-2025-46350?

YesWiki, a PHP-based wiki system, is vulnerable to a reflected cross-site scripting (XSS) attack in versions prior to 4.5.4. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated user, can lead to the theft of cookies. With access to these cookies, attackers can hijack user sessions, posing serious risks such as session takeover and website defacement. Users are advised to upgrade to version 4.5.4 or later to mitigate these security risks.

Affected Version(s)

yeswiki < 4.5.4

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/YesWiki/yeswiki/commit/e2603176a4607b8...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-46350 : Reflected Cross-Site Scripting Vulnerability in YesWiki by YesWiki