{"id":"CVE-2026-116207","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-116207","summary":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the…","details":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().","published":"2026-10-25T14:17:01.847","modified":"2026-10-25T14:17:01.960","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh"},{"type":"WEB","url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-25T14:17:01.960"}}