Packagist/yeswiki/yeswiki CVE-2025-46349: high 7.6, EPSS 0.64%
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 4.5.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-2f8p-qqx2-gwr2
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2
- https://nvd.nist.gov/vuln/detail/CVE-2025-46349
- https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524
- https://github.com/YesWiki/yeswiki/commit/0dac9e2fb2a5e69f13a3c9f761ecae6ed9676206
- https://github.com/YesWiki/yeswiki
- https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735
CVE-2025-46349 · published · modified · JSON