CVE-2025-46349

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.

• CWE-79

• https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524Patch
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2Exploit, Vendor Advisory
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2Exploit, Vendor Advisory

Published

Apr 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46343n8n is a workflow automation platform. Prior to version 1.90…5.4
• CVE-2025-46344The Auth0 Next.js SDK is a library for implementing user aut…4.9
• CVE-2025-46345Auth0 Account Link Extension is an extension aimed to help l…6.9
• CVE-2025-46346YesWiki is a wiki system written in PHP. Prior to version 4.…5.4
• CVE-2025-46347YesWiki is a wiki system written in PHP. Prior to version 4.…9.8
• CVE-2025-46348YesWiki is a wiki system written in PHP. Prior to version 4.…9.8
• CVE-2025-4635A malicious user with administrative privileges in the web p…6.6
• CVE-2025-46350YesWiki is a wiki system written in PHP. Prior to version 4.…4.8
• CVE-2025-46352The CS5000 Fire Panel is vulnerable due to a hard-coded pass…9.8
• CVE-2025-46354A denial of service vulnerability exists in the Distributed …7.5
• CVE-2025-46355Incorrect default permissions issue in PC Time Tracer prior …7.3
• CVE-2025-46358Emerson ValveLink products do not use or incorrectly uses a…8.5