Live › vulnerability › CVE-2026-116828
Go to dashboardYesWiki before 4.7.0 has an SQL injection in despam.php: the from POST parameter is escaped but placed in an unquoted INTERVAL position. An authenticated administrator can run blind SQL reads, including user password hashes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Sites running YesWiki before 4.7.0 where administrators have access to the despam feature. The sources say the attacker must be an authenticated administrator, so the risk is mainly to sites with many admin accounts or shared admin access. unknown for other configurations.
No product ranges from the sources yet.
4.7.0 are affected4.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.
This page as .md · .json · in your agent: get_signal("CVE-2026-116828")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.