Live › vulnerability › CVE-2026-116207
Go to dashboardYesWiki's public Bazar entries search API places field names from the query and searchfields parameters into a backtick-quoted SQL alias that is escaped only with mysqli_real_escape_string. An unauthenticated attacker can inject subqueries to read data such as user password hashes or exhaust database threads with SLEEP().
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Any public YesWiki instance running a version in the affected range, because the flaw is reachable through the unauthenticated Bazar search API with no login needed. Instances on versions outside the stated ranges, or whose Bazar search API is not publicly reachable, are less exposed; the sources do not describe a non-default setting that removes the exposure.
No product ranges from the sources yet.
4.7.0, and 5.0.0-alpha1 up to but not including 5.0.0-alpha4, are affected4.7.0 or later5.0.0-alpha4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
This page as .md · .json · in your agent: get_signal("CVE-2026-116207")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.