CVE-2025-46550CWE-79

Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Medium · published April 29, 2025

CVSS v3.1
4.3
EPSS
1%
Percentile
44.7
In the wild
Unconfirmed
What it is

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00541 · 44.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-04-29T20:41Z
EPSS history
Timeline
  • 29 APR 20:41Z
    Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
    cvelistv5