UpHeron
All vulnerabilities

Servers and applications

CVE-2025-46350

Reflected XSS (Authenticated) in Yeswiki v4.5.1

Severity
Medium 4.8
Published
28 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
4.5.4
Also known as
GHSA-cg4f-cq8h-3ch8
Sources
NVD, Project advisories (GitHub)

Description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been…

Affected software

SoftwareAffected versions
YesWikiServers and applications · cpe:a:yeswiki:yeswiki
  • Every version before 4.5.4
YesWikiServers and applications · github:yeswiki/yeswiki
  • Every version before 4.5.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-46350
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-46350
  • GitHub Advisory Database https://github.com/advisories/GHSA-cg4f-cq8h-3ch8
  • github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-cg4f-cq8h-3ch8