`\n\n### Details\nReflected Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trust","image":"https://o3.security/opengraph.png","datePublished":"2025-04-29T14:35:20Z","dateModified":"2026-09-10T03:50:24.046612069Z","url":"https://o3.security/vulnerability/CVE-2025-46549","inLanguage":"en","author":{"@id":"https://o3.security/#organization"},"publisher":{"@id":"https://o3.security/#organization"},"mainEntityOfPage":{"@type":"WebPage","@id":"https://o3.security/vulnerability/CVE-2025-46549"},"speakable":{"@type":"SpeakableSpecification","cssSelector":["h1",".vuln-summary",".vuln-severity",".vuln-mitigation"]},"about":[{"@type":"SoftwareApplication","name":"yeswiki/yeswiki","applicationCategory":"Packagist","softwareVersion":"4.5.4"}],"citation":[{"@type":"CreativeWork","name":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46549"},{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/CVE-2025-46549"},{"@type":"CreativeWork","name":"FIRST.org EPSS","url":"https://www.first.org/epss/api-data?cve=CVE-2025-46549"},{"@type":"CreativeWork","url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-r9gv-qffm-xw6f"},{"@type":"CreativeWork","url":"https://github.com/YesWiki/yeswiki/commit/107d43056adebaa0c731230f9fd010898e88f3f5"}]}`\n\n### Details\nReflected Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trust","url":"https://o3.security/vulnerability/CVE-2025-46549","identifier":"CVE-2025-46549","datePublished":"2025-04-29T14:35:20Z","dateModified":"2026-09-10T03:50:24.046612069Z","inLanguage":"en","license":"https://creativecommons.org/licenses/by/4.0/","keywords":["CVE-2025-46549","MEDIUM severity","CWE-79","CVE","vulnerability","security advisory"],"creator":{"@id":"https://o3.security/#organization"},"isAccessibleForFree":true,"citation":[{"@type":"CreativeWork","name":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46549"},{"@type":"CreativeWork","name":"OSV.dev","url":"https://osv.dev/vulnerability/CVE-2025-46549"},{"@type":"CreativeWork","name":"FIRST.org EPSS","url":"https://www.first.org/epss/api-data?cve=CVE-2025-46549"}],"variableMeasured":[{"@type":"PropertyValue","name":"CVSS Base Score","value":5.3,"description":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"@type":"PropertyValue","name":"Severity","value":"MEDIUM"},{"@type":"PropertyValue","name":"EPSS Percentile","value":43}]}`\n\n### Details\nReflected Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, gener"}},{"@type":"Question","name":"How severe is GHSA-r9gv-qffm-xw6f?","acceptedAnswer":{"@type":"Answer","text":"GHSA-r9gv-qffm-xw6f has a CVSS score of 5.3/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance."}},{"@type":"Question","name":"Which packages are affected by GHSA-r9gv-qffm-xw6f?","acceptedAnswer":{"@type":"Answer","text":"GHSA-r9gv-qffm-xw6f affects the following packages: yeswiki/yeswiki (Packagist). Ecosystems affected: Packagist."}},{"@type":"Question","name":"How do I fix GHSA-r9gv-qffm-xw6f?","acceptedAnswer":{"@type":"Answer","text":"Update yeswiki/yeswiki to 4.5.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r9gv-qffm-xw6f is resolved across your whole dependency graph."}},{"@type":"Question","name":"How do I detect GHSA-r9gv-qffm-xw6f in my Packagist dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for yeswiki/yeswiki, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version."}},{"@type":"Question","name":"How do I mitigate GHSA-r9gv-qffm-xw6f if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page."}},{"@type":"Question","name":"Is GHSA-r9gv-qffm-xw6f actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for GHSA-r9gv-qffm-xw6f yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"What is the EPSS score for GHSA-r9gv-qffm-xw6f?","acceptedAnswer":{"@type":"Answer","text":"GHSA-r9gv-qffm-xw6f has an EPSS (Exploit Prediction Scoring System) score of 0.5%, placing it in the 43th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority."}},{"@type":"Question","name":"What type of vulnerability is GHSA-r9gv-qffm-xw6f?","acceptedAnswer":{"@type":"Answer","text":"GHSA-r9gv-qffm-xw6f is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure."}},{"@type":"Question","name":"Is there exploit tooling available for GHSA-r9gv-qffm-xw6f?","acceptedAnswer":{"@type":"Answer","text":"A Nuclei detection template exists for GHSA-r9gv-qffm-xw6f, meaning automated scanners can fingerprint it. Public exploit tooling significantly increases real-world risk — prioritize patching and ensure detection coverage. Exploit tooling should only ever be used in isolated, authorized testing environments."}},{"@type":"Question","name":"When was GHSA-r9gv-qffm-xw6f published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"GHSA-r9gv-qffm-xw6f was published on April 29, 2025 and was last updated on September 10, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}
Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

GHSA-r9gv-qffm-xw6f — yeswiki/yeswiki

MEDIUMFix: YesWiki/yeswiki@107d430

GHSA-r9gv-qffm-xw6f is a medium-severity (CVSS 5.3) Cross-site Scripting (XSS) vulnerability in yeswiki/yeswiki. A fix is available for yeswiki/yeswiki — see the affected versions and patch details below.

Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

Also known asCVE-2025-46549
Published
Apr 29, 2025
Updated
Sep 10, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 26, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for GHSA-r9gv-qffm-xw6f.

EPSS Exploitation Probability

via FIRST.org ↗
0.5%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs43th percentile — riskier than 43% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-r9gv-qffm-xw6f by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
🐘yeswiki/yeswiki

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Vulnerable Version: Yeswiki < v4.5.4 Category: Injection CWE: 79: Improper Neutralization of Input During Web Page Generation (CWE-79) CVSS: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vulnerable Endpoint: /?BazaR/bazariframe Vulnerable Parameter: template Payload: <script>alert(1)</script>

Details

Reflected Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

PoC

  1. Visit the endpoint as mentioned below and see that an alert box pops up: URL with Payload: https://yeswiki.net/?BazaR/bazariframe&id=2&template=%3cscript%3ealert(1)%3c%2fscript%3e

Impact

An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link. Stolen cookies allow the attacker to take over the user’s session. This vulnerability may also allow attackers to deface the website or embed malicious content.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistyeswiki/yeswikiall versions4.5.4composer require yeswiki/yeswiki:^4.5.4

Affected Products

1 product · 1 configurations
Application
yeswikiyeswiki
< 4.5.4
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for yeswiki/yeswiki, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update yeswiki/yeswiki to 4.5.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-r9gv-qffm-xw6f is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

How to detect GHSA-r9gv-qffm-xw6f

A community-maintained Nuclei template exists for this CVE. You can scan for it directly:

nuclei -id ghsa-r9gv-qffm-xw6f -u https://target
Template
YesWiki <= 4.5.1 - Cross-Site Scripting
Severity
medium
Impact
Attackers can steal cookies, hijack user sessions, deface websites, or embed malicious content.
Remediation
Update to version 4.5.4 or later.

Template by ProjectDiscovery nuclei-templates (MuhammadWaseem), MIT licensed. View the full template. Scan only systems you are authorised to test.

Frequently Asked Questions

### Summary **Vulnerable Version:** Yeswiki < v4.5.4 **Category:** Injection **CWE: 79:** Improper Neutralization of Input During Web Page Generation (CWE-79) **CVSS:** 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) **Vulnerable Endpoint:** `/?BazaR/bazariframe` **Vulnerable Parameter:** `template` **Payload:** `<script>alert(1)</script>` ### Details Reflected Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, gener
O3 Security · Impact-Aware SCA

Is GHSA-r9gv-qffm-xw6f in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-r9gv-qffm-xw6f: yeswiki/yeswiki | O3 Security