CVE-2025-46349
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | yeswiki/yeswiki | <=4.5.3 | |
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2
- https://nvd.nist.gov/vuln/detail/CVE-2025-46349
- https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524
- https://github.com/YesWiki/yeswiki/commit/0dac9e2fb2a5e69f13a3c9f761ecae6ed9676206
- https://github.com/YesWiki/yeswiki
- https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735
Verify integrity in audit chain (admin only). AS-IS.