{"id":"CVE-2026-116211","kind":"vulnerability","aliases":["CVE-2026-116211"],"related":[],"title":"YesWiki: unescaped Bazar field lets anonymous users dump password hashes","description":"YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.","summary":"YesWiki versions from 4.5.0 before 4.7.0 build an INSERT statement from the date_maj_fiche field of a Bazar entry-creation request without escaping it. An unauthenticated attacker can inject a sub-SELECT against the wiki_users table and read password hashes.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","other","php","self-hosted","yeswiki"],"not_affected_if":["version-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin panel; versions `4.5.0` through `4.6.x` are in the affected range.\n- unknown","fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, unknown","status":"open","published_at":"2026-10-25T14:17:02+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:08+00:00","updated_at":"2026-10-25T14:42:08+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T14:42:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, unknown","reach":"internet","title":"YesWiki: unescaped Bazar field lets anonymous users dump password hashes","impact":"high","summary":"YesWiki versions from 4.5.0 before 4.7.0 build an INSERT statement from the date_maj_fiche field of a Bazar entry-creation request without escaping it. An unauthenticated attacker can inject a sub-SELECT against the wiki_users table and read password hashes.","category":"other","nicknames":[],"who_cares":["yeswiki","self-hosted","php","mysql"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads wiki user password hashes via unauthenticated SQL injection","analyst_note":"Confirm the exact Bazar endpoint and whether a form is required, and find the 4.7.0 upgrade notes or advisory for mitigation steps.","how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin panel; versions `4.5.0` through `4.6.x` are in the affected range.\n- unknown","needs_analyst":true,"not_affected_if":["version-4.7.0-or-later"],"who_is_affected":"Sites running YesWiki 4.5.0 up to but not including 4.7.0 with the Bazar extension handling entry creation are exposed, and the sources describe default installs as affected without authentication. Sites already on 4.7.0 or later are not affected. Whether a Bazar form must exist for the injection path is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000627,"input_tokens":3358,"output_tokens":583,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116211':13A,16A '-2026':12A,15A '4.5.0':27B,69C '4.7.0':29B,71C 'anonym':6A 'attack':52B,101C 'bazar':3A,42B,88C 'build':30B 'concaten':94C 'contain':72C 'creation':45B,91C 'cve':11A,14A 'date':36B,82C 'default':103C 'dump':8A 'entri':44B,90C 'entry-cr':43B,89C 'escap':48B 'exfiltr':115C 'fich':38B,84C 'field':4A,39B,85C 'hash':10A,67B,117C 'host':22B 'inject':54B,75C,106C 'insert':32B,98C 'instal':104C 'let':5A 'maj':37B,83C 'mysql':17B 'pagemanag':78C 'password':9A,66B,116C 'php':19B 'read':65B 'request':46B,92C 'save':79C 'select':58B,110C 'self':21B 'self-host':20B 'sql':74C 'statement':33B,99C 'sub':57B,109C 'sub-select':56B,108C 'tabl':63B 'unauthent':51B,100C 'unescap':2A,95C 'user':7A,62B,113C 'version':25B 'vulner':76C 'wiki':61B,112C 'without':47B 'yeswiki':1A,23B,24B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running YesWiki 4.5.0 up to but not including 4.7.0 with the Bazar extension handling entry creation are exposed, and the sources describe default installs as affected without authentication. Sites already on 4.7.0 or later are not affected. Whether a Bazar form must exist for the injection path is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116211","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116211","severity":null,"published_at":"2026-10-25T14:17:02+00:00","modified_at":"2026-10-25T14:17:02+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}