CVE-2025-46349: falha de alta gravidade em yeswiki
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Publicada em
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 7.6epss 0.6%
probabilidade de exploração
0.6%top 51% das CVEs
exploração observada
nãonenhuma fonte reporta
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Produtos afetados
YesWiki · yeswikiCVEs relacionadas — yeswiki
No mesmo produto, das mais perigosas para as menos.
CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.5%CVE-2026-46670CRITICALYesWiki: Unauthenticated SQL InjectionEPSS 2.0%CVE-2025-46347MEDIUMYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionEPSS 1.0%CVE-2026-52778CRITICALYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)EPSS 0.8%CVE-2026-52762HIGHYesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesEPSS 0.8%CVE-2026-52774MEDIUMReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiEPSS 0.7%