CVE-2025-46347

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a file with a PHP extension, which then can be browsed to in order to execute arbitrary code on the server, resulting in a full compromise of the server. This could potentially be performed unwittingly by a user. This issue has been patched in version 4.5.4.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
YesWiki	yeswiki	< 4.5.4

References

https://github.com/YesWiki/yeswiki/commit/8fe5275a78dc7e0f9c242baa3cbac6b5ac1cc066Patch
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-88xg-v53p-fpvfExploit, Vendor Advisory
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-88xg-v53p-fpvfExploit, Vendor Advisory

Timeline

Published: Apr 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-463489.8YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded witho CVE-2025-463496.1YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulner CVE-2025-46356.6A malicious user with administrative privileges in the web portal would be able to manipulate the Diagnostics module to obtain remote code e CVE-2025-463504.8YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookie CVE-2025-463529.8The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary respon CVE-2025-463547.5A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A spec CVE-2025-463557.0Incorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on Wi CVE-2025-463587.7Emerson ValveLink products do not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks CVE-2025-463597.2A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary CVE-2025-46367.8Due to excessive privileges granted to the web user running the airpointer web platform, a malicious actor that gains control of the this us CVE-2025-463625.5Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain an Improper Access Control vulnerability. A low privileged at CVE-2025-463634.3Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative Path Traversal vulner