{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.5.3"}],"component":"yeswiki/yeswiki","cve_ids":["CVE-2025-46349"],"ecosystem":"Packagist","epss":0.00643,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-2f8p-qqx2-gwr2","id":"tcs_01M5KERWQZTVT8HY2TA6QV2704","modified_at":"2026-09-10T03:50:56.891754907Z","published_at":"2025-04-29T14:38:12Z","references":["https://osv.dev/vulnerability/GHSA-2f8p-qqx2-gwr2","https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2","https://nvd.nist.gov/vuln/detail/CVE-2025-46349","https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524","https://github.com/YesWiki/yeswiki/commit/0dac9e2fb2a5e69f13a3c9f761ecae6ed9676206","https://github.com/YesWiki/yeswiki","https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735"],"severity":{"label":"high","score":7.6},"sources":[{"source":"osv","source_id":"GHSA-2f8p-qqx2-gwr2","url":"https://osv.dev/vulnerability/GHSA-2f8p-qqx2-gwr2"}],"summary":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting"}