What’s Vulnerable › Vulnerabilities
CVE-2026-116207: YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-25 · updated 2026-10-26
- Weakness: CWE-89
Description
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Summary
YesWiki versions 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contain an unauthenticated SQL injection in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string, so attackers can supply a backtick to inject subqueries and read data such as user password hashes or exhaust database threads with SLEEP(). Rated CVSS 9.1 critical; it is not in CISA KEV and EPSS gives a 0.3% chance of exploitation in 30 days. Upgrade to 4.7.0 or 5.0.0-alpha4.
تحتوي إصدارات YesWiki من 4.6.0 قبل 4.7.0 ومن 5.0.0-alpha1 قبل 5.0.0-alpha4 على ثغرة حقن SQL غير مصادَق عليها في SearchManager::prepareSearchRequest(). إذ تُدرَج أسماء الحقول الواردة من المعاملين query وsearchfields في واجهة البحث العامة لمدخلات Bazar داخل alias محاط بعلامات backtick ويُهرَّب باستخدام mysqli_real_escape_string فقط، ما يتيح للمهاجم تمرير backtick لحقن استعلامات فرعية وقراءة بيانات مثل تجزئات كلمات مرور المستخدمين أو استنزاف خيوط قاعدة البيانات عبر SLEEP(). صُنِّفت الثغرة بدرجة 9.1 حرجة، وهي غير مدرجة في CISA KEV، وتقدّر EPSS احتمال استغلالها خلال 30 يوماً بنسبة 0.3%. يُنصح بالترقية إلى 4.7.0 أو 5.0.0-alpha4.
Affected products
- yeswiki: from 4.6.0 before 4.7.0 — fixed in 4.7.0
How to fix
Upgrade to a fixed version: yeswiki 4.7.0. Check the vendor advisory for mitigations.
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877
- https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api
Get alerted when CVE-2026-116207 or the next vulnerability affects your stack