YesWiki < 4.5.4 - Cross-Site Scripting Detection

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki 4.""" from kittysploit...

CVE-2025-46550

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the "/?BazaR" endpoint and "idformulaire" parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the idformulaire parameter. An attacker can manipulate the web content viewed by other users by injecting malicious scripts into the URL. That can allow stealing cookies from an authenticated user by...

CVE-2025-46550: Improper Neutralization of Input During Web Page Generation

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the /?BazaR endpoint and idformulaire parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link...

YesWiki Cross-site Scripting Vulnerabilities

YesWiki is a wiki system written in PHP by the French organization YesWiki. It is used to create and manage websites in a collaborative manner. A cross-site scripting vulnerability exists in YesWiki versions prior to 4.5.4, which stems from a cross-site scripting attack on the /?BazaR endpoint an...