CVE-2026-116207
Published:October 25, 2026
Updated:November 04, 2026
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Affected Packages
https://github.com/YesWiki/yeswiki.git (GITHUB):
Affected version(s) >=v5.0.0-alpha1 <v5.0.0-alpha4Fix Suggestion:
Update to version v5.0.0-alpha4https://github.com/YesWiki/yeswiki.git (GITHUB):
Affected version(s) >=v4.6.0 <v4.7.0Fix Suggestion:
Update to version v4.7.0yeswiki/yeswiki (PHP):
Affected version(s) >=v4.6.0 <v4.7.0Fix Suggestion:
Update to version v4.7.0yeswiki/yeswiki (PHP):
Affected version(s) >=v5.0.0-alpha1 <v5.0.0-alpha4Fix Suggestion:
Update to version v5.0.0-alpha4Related Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
HIGH
Weakness Type (CWE)
Improper Neutralization of Special Elements used in an SQL Command
EPSS
Base Score:
0.31