Sign in
Deutsch English Español Polski
Low

Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting

  • Disclosed: 29.04.2025
  • Updated: 11.10.2026 10:22

Summary

Vulnerable Version: Yeswiki < v4.5.4 Vulnerable Endpoint: /?PagePrincipale%2Fdeletepage Vulnerable Parameter: incomingurl Payload: "><script>alert(1)</script>

Details

Reflected Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

PoC

NOTE: This vulnerability requires admin access.

  1. Visit the endpoint as mentioned below and see that an alert box pops up:

    URL with Payload: https://yeswiki.net/?PagePrincipale%2Fdeletepage&incomingurl="><script>alert(1)</script>

Impact

An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package yeswiki/yeswiki < 4.5.4 4.5.4

References

CVSS score 3.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
yeswiki/yeswiki
Disclosed
29.04.2025
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cg4f-cq8h-3ch8 - CC BY 4.0

Vulnerability history: yeswiki/yeswiki

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (31) in the archive
Total entries
31
First → latest
03.2022 07.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 16
  • Medium 8
  • Low 2

Disclosures per year

Severity:
  1. YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service
    Critical · 9.8 CVE-2026-52778 < 4.6.6 4.6.6
  2. YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize
    Critical CVE-2026-52777 < 4.6.6 4.6.6
  3. YesWiki has Authenticated SQL Injection via ReactionManager
    High · 8.8 CVE-2026-52775 < 4.6.6 4.6.6
  4. YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
    High · 8.3 CVE-2026-52771 >= 4.2.0, < 4.6.6 4.6.6
  5. YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
    High · 7.5 CVE-2026-52770 < 4.6.6 4.6.6
  6. YesWiki has Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`
    High · 8.3 CVE-2026-52769 >= 4.6.2, < 4.6.6 4.6.6
  7. YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`
    High · 8.2 CVE-2026-52767 >= 4.6.2, < 4.6.6 4.6.6
  8. YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action
    Critical · 9.1 CVE-2026-52766 < 4.6.6 4.6.6
  9. YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
    High CVE-2026-52762 < 4.6.6 4.6.6
  10. YesWiki: Unauthenticated SQL Injection
    Critical · 9.8 CVE-2026-46670 < 4.6.4 4.6.4
  11. YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()
    High · 8.8 CVE-2026-41143 < 4.6.1 4.6.1
  12. YesWiki has Persistent Blind XSS at "/?BazaR&vue=consulter"
    High CVE-2026-34598 < 4.6.0 4.6.0
  13. YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
    High CVE-2025-46347 < 4.5.4 4.5.4
  14. YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
    Critical · 10.0 CVE-2025-46348 < 4.5.4 4.5.4
  15. YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
    High · 7.6 CVE-2025-46349 <= 4.5.3 no fix
  16. Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting this entry
    Low · 3.8 CVE-2025-46350 < 4.5.4 4.5.4
  17. Yeswiki Path Traversal vulnerability allows arbitrary read of files
    High · 8.6 CVE-2025-31131 < 4.5.2 4.5.2
  18. Authenticated arbitrary file deletion in YesWiki
    High · 7.1 CVE-2025-24019 < 4.5.0 4.5.0
  19. Authenticated Stored XSS in YesWiki
    High · 7.6 CVE-2025-24018 < 4.5.0 4.5.0
  20. Unauthenticated DOM Based XSS in YesWiki
    High · 7.6 CVE-2025-24017 < 4.5.0 4.5.0
  21. YesWiki Uses a Broken or Risky Cryptographic Algorithm
    High · 9.9 CVE-2024-51478 < 4.4.5 4.4.5
  22. SQL Injection in Yeswiki
    High · 7.5 CVE-2021-43091 < 4.1.0 4.1.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.