Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2011-5025: Yaws wiki lets attackers insert malicious scripts
CVE-2011-5025 · published 14 years ago
Summary
The wiki feature in Yaws version 1.88 can be tricked into running attacker‑provided code when certain fields are used. This could let a remote user steal information or take over user sessions. Apply the latest Yaws update or patch the wiki component to stop the problem.
What to do
- Update debian yaws to version 1.92-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | yaws |
< 1.92-1 Fix: upgrade to 1.92-1
|
| Debian:13 | debian | yaws |
< 1.92-1 Fix: upgrade to 1.92-1
|
| Debian:14 | debian | yaws |
< 1.92-1 Fix: upgrade to 1.92-1
|
| – | yaws | yaws |
1.88 cpe:2.3:a:yaws:yaws:1.88:*:*:*:*:*:*:* |
Original advisory text
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws, (2)...
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws, (2) the index parameter to showOldPage.yaws, (3) the node parameter to allRefsToMe.yaws, or (4) the text parameter to editPage.yaws.
References
- https://security-tracker.debian.org/tracker/CVE-2011-5025 Vendor Advisory
- http://www.securityfocus.com/bid/51276
- https://sitewat.ch/Advisory/View/4 URL Repurposed
Severity
4.3
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published29 Dec 2011
Updated30 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta