p PatchFirst

CVE-2026-116207

CVE-2026-116207 · YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

This page contains facts from public vulnerability sources. Check the original advisory before updating.

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

CVSS 8.8 · High · EPSS 0.3% · Fix available

Published
Updated

Affected products and versions

  • yeswiki

    Versions
    • ≥ 4.6.0, < 4.7.0: Affected (semver)
    • 4.7.0: Not affected (semver)

    Update to 4.7.0

  • yeswiki

    Versions
    • ≥ 5.0.0-alpha1, < 5.0.0-alpha4: Affected (semver)
    • 5.0.0-alpha4: Not affected (semver)

    Update to 5.0.0-alpha4

Original sources

Check your server →