YesWiki < 4.5.4 - Cross-Site Scripting
YesWiki References: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ggqx-43h2-55jp https://nvd.nist.gov/vuln/detail/CVE-2025-46550 Remediation: Update to version 4.5.4 or later.
url
CVE
CVE-2025-46550
4.3
CVSSmedium
Exploitable remotely over the internet · no authentication required · user interaction needed.
Description
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.
Attack Vector
Network
Privileges Req.
None
User Interaction
Required
yeswiki
Updated Nov 10, 2026View on NVD →
S4E scanner
CVE history: yeswiki
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →