CVE-2025-46346

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user viewing the affected comment. The XSS occurs because the application fails to properly sanitize or encode user input submitted to the comments. Notably, the application sanitizes or does not allow execution of `<script>` tags, but does not account for payloads obfuscated using JavaScript block comments like `/* JavaScriptPayload */`. This issue has been patched in version 4.5.4.

• CWE-79

• https://github.com/YesWiki/yeswiki/commit/0d4efc880a727599fa4f6d7a64cc967afe475530Patch
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-59x8-cvxh-3mm4Exploit, Vendor Advisory
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-59x8-cvxh-3mm4Exploit, Vendor Advisory

Published

Apr 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46340Misskey is an open source, federated social media platform. …5.4
• CVE-2025-46341FreshRSS is a self-hosted RSS feed aggregator. Prior to vers…7.1
• CVE-2025-46342Kyverno is a policy engine designed for cloud native platfor…8.2
• CVE-2025-46343n8n is a workflow automation platform. Prior to version 1.90…5.4
• CVE-2025-46344The Auth0 Next.js SDK is a library for implementing user aut…4.9
• CVE-2025-46345Auth0 Account Link Extension is an extension aimed to help l…6.9
• CVE-2025-46347YesWiki is a wiki system written in PHP. Prior to version 4.…9.8
• CVE-2025-46348YesWiki is a wiki system written in PHP. Prior to version 4.…9.8
• CVE-2025-46349YesWiki is a wiki system written in PHP. Prior to version 4.…6.1
• CVE-2025-4635A malicious user with administrative privileges in the web p…6.6
• CVE-2025-46350YesWiki is a wiki system written in PHP. Prior to version 4.…4.8
• CVE-2025-46352The CS5000 Fire Panel is vulnerable due to a hard-coded pass…9.8