CVE-2025-46550

Public Exploit
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.

Category

4.3
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.03%
Vendor Advisory github.com
Affected: YesWiki yeswiki
Published at:
Updated at:

References

Link Tags
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ggqx-43h2-55jp vendor advisory exploit
https://github.com/YesWiki/yeswiki/commit/4e9e51d80cd024ed2ac5c12c820817e6d8c2655a patch

Frequently Asked Questions

What is the severity of CVE-2025-46550?
CVE-2025-46550 has been scored as a medium severity vulnerability.
How to fix CVE-2025-46550?
To fix CVE-2025-46550, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-46550 being actively exploited in the wild?
It is possible that CVE-2025-46550 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-46550?
CVE-2025-46550 affects YesWiki yeswiki.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.