CVE-2025-46349 PoC — YesWiki 跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46349.yaml

Associated Vulnerability

Title:YesWiki 跨站脚本漏洞 (CVE-2025-46349)
Description:YesWiki是法国YesWiki组织的一个用 PHP 编写的 wiki 系统。用于以协作方式创建和管理网站。 YesWiki 4.5.4之前版本存在跨站脚本漏洞，该漏洞源于文件上传表单存在反射型跨站脚本攻击。

Description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.

File Snapshot


 id: CVE-2025-46349

info:
  name: YesWiki Reflected XSS via File Upload
  author: Mahmoud Gamal
  se

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!