CVE-2025-24018 YesWiki Vulnerable to Authenticated Stored XSS

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for an authenticated user with rights to edit/create a page or comment to trigger a stored XSS which will be reflected on any page where the resource is loaded. The vulnerability makes use of the conten...

CVE-2025-24018

YesWiki 4.4.5 and earlier are vulnerable to an authenticated stored XSS via the attach component. The root cause is unsafe handling of non-existent filenames in the attach.lib.php showFileNotExits() path, which can emit a file upload button containing the filename and allow script injection when ...

CVE-2025-24018

creationtimestamp| type| source ---|---|--- 2025-01-21 09:45:47+00:00| published-proof-of-concept| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w59h-3x3q-3p6j 2025-01-21 17:09:50+00:00| seen| https://infosec.exchange/users/cve/statuses/113867449282015793 2025-01-21 17:16:04+00:00|...