CVE-2025-46549 PoC — Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46549.yaml

Associated Vulnerability

Title: Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting (CVE-2025-46549)
Description:YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.

Description

YesWiki <= 4.5.1 contains a reflected cross-site scripting caused by insufficient sanitization in user input, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →