{"id":"CVE-2025-7887","state":"PUBLISHED","title":"Zavy86 WikiDocs template.inc.php cross site scripting","description":"A vulnerability has been found in Zavy86 WikiDocs up to 1.0.78 and classified as problematic. This vulnerability affects unknown code of the file template.inc.php. The manipulation of the argument path leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.","publishedAt":"2025-07-20T11:44:05.636Z","updatedAt":"2025-07-21T13:19:35.520Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Zavy86 WikiDocs"],"affected":[{"vendor":"Zavy86","product":"WikiDocs","versions":[{"version":"1.0.0","status":"affected"},{"version":"1.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.0.3","status":"affected"},{"version":"1.0.4","status":"affected"},{"version":"1.0.5","status":"affected"},{"version":"1.0.6","status":"affected"},{"version":"1.0.7","status":"affected"},{"version":"1.0.8","status":"affected"},{"version":"1.0.9","status":"affected"},{"version":"1.0.10","status":"affected"},{"version":"1.0.11","status":"affected"},{"version":"1.0.12","status":"affected"},{"version":"1.0.13","status":"affected"},{"version":"1.0.14","status":"affected"},{"version":"1.0.15","status":"affected"},{"version":"1.0.16","status":"affected"},{"version":"1.0.17","status":"affected"},{"version":"1.0.18","status":"affected"},{"version":"1.0.19","status":"affected"},{"version":"1.0.20","status":"affected"},{"version":"1.0.21","status":"affected"},{"version":"1.0.22","status":"affected"},{"version":"1.0.23","status":"affected"},{"version":"1.0.24","status":"affected"},{"version":"1.0.25","status":"affected"},{"version":"1.0.26","status":"affected"},{"version":"1.0.27","status":"affected"},{"version":"1.0.28","status":"affected"},{"version":"1.0.29","status":"affected"},{"version":"1.0.30","status":"affected"},{"version":"1.0.31","status":"affected"},{"version":"1.0.32","status":"affected"},{"version":"1.0.33","status":"affected"},{"version":"1.0.34","status":"affected"},{"version":"1.0.35","status":"affected"},{"version":"1.0.36","status":"affected"},{"version":"1.0.37","status":"affected"},{"version":"1.0.38","status":"affected"},{"version":"1.0.39","status":"affected"},{"version":"1.0.40","status":"affected"},{"version":"1.0.41","status":"affected"},{"version":"1.0.42","status":"affected"},{"version":"1.0.43","status":"affected"},{"version":"1.0.44","status":"affected"},{"version":"1.0.45","status":"affected"},{"version":"1.0.46","status":"affected"},{"version":"1.0.47","status":"affected"},{"version":"1.0.48","status":"affected"},{"version":"1.0.49","status":"affected"},{"version":"1.0.50","status":"affected"},{"version":"1.0.51","status":"affected"},{"version":"1.0.52","status":"affected"},{"version":"1.0.53","status":"affected"},{"version":"1.0.54","status":"affected"},{"version":"1.0.55","status":"affected"},{"version":"1.0.56","status":"affected"},{"version":"1.0.57","status":"affected"},{"version":"1.0.58","status":"affected"},{"version":"1.0.59","status":"affected"},{"version":"1.0.60","status":"affected"},{"version":"1.0.61","status":"affected"},{"version":"1.0.62","status":"affected"},{"version":"1.0.63","status":"affected"},{"version":"1.0.64","status":"affected"},{"version":"1.0.65","status":"affected"},{"version":"1.0.66","status":"affected"},{"version":"1.0.67","status":"affected"},{"version":"1.0.68","status":"affected"},{"version":"1.0.69","status":"affected"},{"version":"1.0.70","status":"affected"},{"version":"1.0.71","status":"affected"},{"version":"1.0.72","status":"affected"},{"version":"1.0.73","status":"affected"},{"version":"1.0.74","status":"affected"},{"version":"1.0.75","status":"affected"},{"version":"1.0.76","status":"affected"},{"version":"1.0.77","status":"affected"},{"version":"1.0.78","status":"affected"}]}],"references":["https://vuldb.com/?id.317002","https://vuldb.com/?ctiid.317002","https://vuldb.com/?submit.609063","https://github.com/Zavy86/WikiDocs/issues/256","https://github.com/Zavy86/WikiDocs/issues/256#issuecomment-3034714777","https://github.com/Zavy86/WikiDocs/issues/256#issue-3201516458"],"weaknesses":["CWE-79","CWE-94"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/7xxx/CVE-2025-7887.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-7887","state":"PUBLISHED","datePublished":"2025-07-20T11:44:05.636Z","dateUpdated":"2025-07-21T13:19:35.520Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-07-19T08:14:39.991Z"},"containers":{"cna":{"title":"Zavy86 WikiDocs template.inc.php cross site scripting","descriptions":[{"lang":"en","value":"A vulnerability has been found in Zavy86 WikiDocs up to 1.0.78 and classified as problematic. This vulnerability affects unknown code of the file template.inc.php. The manipulation of the argument path leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."},{"lang":"de","value":"In Zavy86 WikiDocs bis 1.0.78 wurde eine problematische Schwachstelle gefunden. Betroffen ist eine unbekannte Verarbeitung der Datei template.inc.php. Durch Manipulation des Arguments path mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Zavy86","product":"WikiDocs","versions":[{"version":"1.0.0","status":"affected"},{"version":"1.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.0.3","status":"affected"},{"version":"1.0.4","status":"affected"},{"version":"1.0.5","status":"affected"},{"version":"1.0.6","status":"affected"},{"version":"1.0.7","status":"affected"},{"version":"1.0.8","status":"affected"},{"version":"1.0.9","status":"affected"},{"version":"1.0.10","status":"affected"},{"version":"1.0.11","status":"affected"},{"version":"1.0.12","status":"affected"},{"version":"1.0.13","status":"affected"},{"version":"1.0.14","status":"affected"},{"version":"1.0.15","status":"affected"},{"version":"1.0.16","status":"affected"},{"version":"1.0.17","status":"affected"},{"version":"1.0.18","status":"affected"},{"version":"1.0.19","status":"affected"},{"version":"1.0.20","status":"affected"},{"version":"1.0.21","status":"affected"},{"version":"1.0.22","status":"affected"},{"version":"1.0.23","status":"affected"},{"version":"1.0.24","status":"affected"},{"version":"1.0.25","status":"affected"},{"version":"1.0.26","status":"affected"},{"version":"1.0.27","status":"affected"},{"version":"1.0.28","status":"affected"},{"version":"1.0.29","status":"affected"},{"version":"1.0.30","status":"affected"},{"version":"1.0.31","status":"affected"},{"version":"1.0.32","status":"affected"},{"version":"1.0.33","status":"affected"},{"version":"1.0.34","status":"affected"},{"version":"1.0.35","status":"affected"},{"version":"1.0.36","status":"affected"},{"version":"1.0.37","status":"affected"},{"version":"1.0.38","status":"affected"},{"version":"1.0.39","status":"affected"},{"version":"1.0.40","status":"affected"},{"version":"1.0.41","status":"affected"},{"version":"1.0.42","status":"affected"},{"version":"1.0.43","status":"affected"},{"version":"1.0.44","status":"affected"},{"version":"1.0.45","status":"affected"},{"version":"1.0.46","status":"affected"},{"version":"1.0.47","status":"affected"},{"version":"1.0.48","status":"affected"},{"version":"1.0.49","status":"affected"},{"version":"1.0.50","status":"affected"},{"version":"1.0.51","status":"affected"},{"version":"1.0.52","status":"affected"},{"version":"1.0.53","status":"affected"},{"version":"1.0.54","status":"affected"},{"version":"1.0.55","status":"affected"},{"version":"1.0.56","status":"affected"},{"version":"1.0.57","status":"affected"},{"version":"1.0.58","status":"affected"},{"version":"1.0.59","status":"affected"},{"version":"1.0.60","status":"affected"},{"version":"1.0.61","status":"affected"},{"version":"1.0.62","status":"affected"},{"version":"1.0.63","status":"affected"},{"version":"1.0.64","status":"affected"},{"version":"1.0.65","status":"affected"},{"version":"1.0.66","status":"affected"},{"version":"1.0.67","status":"affected"},{"version":"1.0.68","status":"affected"},{"version":"1.0.69","status":"affected"},{"version":"1.0.70","status":"affected"},{"version":"1.0.71","status":"affected"},{"version":"1.0.72","status":"affected"},{"version":"1.0.73","status":"affected"},{"version":"1.0.74","status":"affected"},{"version":"1.0.75","status":"affected"},{"version":"1.0.76","status":"affected"},{"version":"1.0.77","status":"affected"},{"version":"1.0.78","status":"affected"}]}],"references":[{"url":"https://vuldb.com/?id.317002","name":"VDB-317002 | Zavy86 WikiDocs template.inc.php cross site scripting","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.317002","name":"VDB-317002 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.609063","name":"Submit #609063 | Zavy86 WikiDocs 1.0.77 Cross Site Scripting","tags":["third-party-advisory"]},{"url":"https://github.com/Zavy86/WikiDocs/issues/256","tags":["issue-tracking"]},{"url":"https://github.com/Zavy86/WikiDocs/issues/256#issuecomment-3034714777","tags":["issue-tracking"]},{"url":"https://github.com/Zavy86/WikiDocs/issues/256#issue-3201516458","tags":["exploit","issue-tracking"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","type":"CWE","lang":"en","description":"Cross Site Scripting"}]},{"descriptions":[{"cweId":"CWE-94","type":"CWE","lang":"en","description":"Code Injection"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-07-20T11:44:05.636Z"},"timeline":[{"time":"2025-07-19T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-07-19T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-07-19T12:45:44.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Matan Haim Sandori","type":"finder"},{"lang":"en","value":"MatanS (VulDB User)","type":"reporter"},{"lang":"en","value":"MatanS (VulDB User)","type":"analyst"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/Zavy86/WikiDocs/issues/256","tags":["exploit"]},{"url":"https://github.com/Zavy86/WikiDocs/issues/256#issue-3201516458","tags":["exploit"]},{"url":"https://github.com/Zavy86/WikiDocs/issues/256#issuecomment-3034714777","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-21T13:19:26.531327Z","id":"CVE-2025-7887","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-21T13:19:35.520Z"}}]}}}