Medium severity · published Apr 29, 2025
CVE-2025-46550
YesWiki is a wiki system written in PHP
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YE
Yeswiki · Yeswiki
before 4.5.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-46550
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-46550
Patch
https://github.com/YesWiki/yeswiki/commit/4e9e51d80cd024ed2ac5c12c820817e6d8c2655a
Exploit
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ggqx-43h2-55jp
More from Yeswiki
9.8
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
9.8
CVE-2026-52778
YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
9.8
CVE-2025-46348
YesWiki is a wiki system written in PHP
9.8
CVE-2025-46347
YesWiki is a wiki system written in PHP
9.8
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…