CVE-2025-46550 PoC — Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46550.yaml

Associated Vulnerability

Title:Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting (CVE-2025-46550)
Description:YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content. This issue has been patched in version 4.5.4.

Description

YesWiki < 4.5.4 contains a reflected cross-site scripting caused by unsanitized `idformulaire` parameter in `/?BazaR` endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link.

File Snapshot


 id: CVE-2025-46550

info:
  name: YesWiki < 4.5.4 - Cross-Site Scripting
  author: MuhammadWaseem
  

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!