Live › vulnerability › CVE-2026-116820
Go to dashboardYesWiki from 4.6.0 before 4.7.0 shows assembled SQL queries when an attacker adds the showreq parameter to public Bazar listing API requests. The leaked table names, JSON storage paths, ACL filter logic and collation give an attacker what they need to craft targeted SQL injection.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Any YesWiki installation from 4.6.0 before 4.7.0 that exposes Bazar listing API endpoints to the public is exposed, because the leak needs no login. Sites where those endpoints are restricted to logged-in users, or that run a version outside this range, are not affected by this description.
No product ranges from the sources yet.
4.6.0 or later but before 4.7.0showreq appended and see whether SQL query text is returned4.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.
This page as .md · .json · in your agent: get_signal("CVE-2026-116820")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.