{"id":"CVE-2026-116828","kind":"vulnerability","aliases":["CVE-2026-116828"],"related":[],"title":"YesWiki: SQL injection in despam.php lets admins read the database","description":"YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.","summary":"YesWiki before 4.7.0 has an SQL injection in despam.php: the from POST parameter is escaped but placed in an unquoted INTERVAL position. An authenticated administrator can run blind SQL reads, including user password hashes.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["auth-required"],"how_to_check":"- Check the installed YesWiki version; the sources say versions before `4.7.0` are affected\n- unknown","fix":"- Upgrade YesWiki to `4.7.0` or later\n- unknown","status":"open","published_at":"2026-10-27T00:17:18+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:25+00:00","updated_at":"2026-10-27T00:26:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later\n- unknown","reach":"internet","title":"YesWiki: SQL injection in despam.php lets admins read the database","impact":"medium","summary":"YesWiki before 4.7.0 has an SQL injection in despam.php: the from POST parameter is escaped but placed in an unquoted INTERVAL position. An authenticated administrator can run blind SQL reads, including user password hashes.","category":"package","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Blind SQL reads expose user password hashes and other database data","analyst_note":"","how_to_check":"- Check the installed YesWiki version; the sources say versions before `4.7.0` are affected\n- unknown","needs_analyst":false,"not_affected_if":["auth-required"],"who_is_affected":"Sites running YesWiki before `4.7.0` where administrators have access to the despam feature. The sources say the attacker must be an authenticated administrator, so the risk is mainly to sites with many admin accounts or shared admin access. unknown for other configurations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000555,"input_tokens":3318,"output_tokens":446,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116828':13A,16A '-2026':12A,15A '4.7.0':25B,59C 'admin':7A 'administr':47B,81C 'authent':46B,80C 'blind':50B,92C 'contain':60C 'cve':11A,14A 'databas':10A,96C 'despam.php':5A,31B,66C 'escap':37B,72C 'hash':56B,100C 'host':21B 'includ':53B,97C 'inject':3A,29B,63C,83C 'interv':43B,78C 'let':6A 'packag':17B 'paramet':35B,70C,89C 'password':55B,99C 'perform':91C 'php':18B 'place':39B,74C 'posit':44B,79C 'post':34B,88C 'read':8A,52B,93C 'run':49B 'self':20B 'self-host':19B 'sql':2A,28B,51B,62C,84C 'unquot':42B,77C 'user':54B,98C 'via':85C 'vulner':64C 'yeswiki':1A,22B,23B,57C","nicknames":[],"mitigations":[],"who_affected":"Sites running YesWiki before `4.7.0` where administrators have access to the despam feature. The sources say the attacker must be an authenticated administrator, so the risk is mainly to sites with many admin accounts or shared admin access. unknown for other configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116828","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116828","severity":null,"published_at":"2026-10-27T00:17:18+00:00","modified_at":"2026-10-27T00:17:19+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}