Reflected Cross-Site Scripting Vulnerability in YesWiki by YesWiki
CVE-2025-46549

6.1MEDIUM

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
29 April 2025

What is CVE-2025-46549?

YesWiki, a wiki system written in PHP, has a vulnerability that allows attackers to execute reflected cross-site scripting. This occurs when an authenticated user clicks on a specially crafted malicious link, enabling the attacker to steal session cookies. The compromised cookies can lead to session hijacking, allowing unauthorized access to the user's account. Additionally, this vulnerability may permit attackers to deface the website or inject malicious content. This critical issue has been resolved in version 4.5.4.

Affected Version(s)

yeswiki < 4.5.4

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/YesWiki/yeswiki/commit/107d43056adebaa...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.