CVE-2025-46347— YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-46347
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
Source: NVD (National Vulnerability Database)
Vulnerability Description
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a file with a PHP extension, which then can be browsed to in order to execute arbitrary code on the server, resulting in a full compromise of the server. This could potentially be performed unwittingly by a user. This issue has been patched in version 4.5.4.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对输出编码和转义不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
YesWiki 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
YesWiki是法国YesWiki组织的一个用 PHP 编写的 wiki 系统。用于以协作方式创建和管理网站。 YesWiki 4.5.4之前版本存在安全漏洞，该漏洞源于任意文件写入，可能导致远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-46347
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-46347
请登录查看更多情报信息。
Same Patch Batch · YesWiki · 2025-04-29 · 7 CVEs total
| CVE-2025-46348 | 10.0 CRITICAL | YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download |
| CVE-2025-46349 | 7.6 HIGH | YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting |
| CVE-2025-46549 | 4.3 MEDIUM | Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting |
| CVE-2025-46550 | 4.3 MEDIUM | Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting |
| CVE-2025-46350 | 3.5 LOW | Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting |
| CVE-2025-46346 | YesWiki Vulnerable to Stored XSS in Comments |
IV. Related Vulnerabilities
Same product: yeswiki
- CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fic - CVE-2026-34598
YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" - CVE-2025-46550
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site S - CVE-2025-46549
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site S - CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation a
Same vendor: YesWiki
- CVE-2026-41143
YesWiki vulnerable to authenticated SQL Injection via id_fic - CVE-2026-34598
YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" - CVE-2025-46550
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site S - CVE-2025-46549
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site S - CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation a
Same weakness: CWE-116
- CVE-2026-42810
Apache Polaris: could broaden vended S3 credentials through - CVE-2026-42040
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLS - CVE-2026-40567
FreeScout has HTML Injection in Outgoing Emails via Unsaniti - CVE-2026-6058
Zyxel WRE6505 安全漏洞 - CVE-2026-20136
Cisco Identity Services Engine Authenticated Privilege Escal
V. Comments for CVE-2025-46347
No comments yet