CVE-2026-116207

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

Published Oct 25, 2026 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Description

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

Analysis

Technical impact

This vulnerability allows attackers to inject arbitrary SQL code through the public Bazar entries search API by embedding a backtick in the field names passed in the query. The injection can read sensitive data such as user password hashes or cause denial of service by flooding the database with long-running queries. The weakness is a classic injectable statement problem (CWE‑89).

Affected Systems

YesWiki versions 4.6.0 through 4.6.x, and 5.0.0‑alpha1 through alpha4 are vulnerable. The affected component is the SearchManager::prepareSearchRequest() function in the Bazar search API.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity level. The EPSS score is currently not available, so the likelihood of exploitation is uncertain, but the vulnerability is unauthenticated and publicly reachable, making it a lucrative target for attackers. The vulnerability is not listed in CISA’s KEV catalog. With the backtick exploitation it is possible for an attacker to run arbitrary SQL commands, potentially leading to full data exfiltration or database exhaustion. The attack vector is the public web API endpoint used for searching Bazar entries.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

YesWiki

yeswiki

unaffected

Version	Status	Constraints
`4.6.0`	affected	< 4.7.0
`4.7.0`	unaffected	—

YesWiki

yeswiki

unaffected

Version	Status	Constraints
`5.0.0-alpha1`	affected	< 5.0.0-alpha4
`5.0.0-alpha4`	unaffected	—

No data.

Vendor Product Versions

Yeswiki

Version	Status	Scheme	Platform
`[4.6.0,4.7.0)`	affected	semver	—
`4.7.0`	unaffected	semver	—

Yeswiki

Version	Status	Scheme	Platform
`[5.0.0-alpha1,5.0.0-alpha4)`	affected	semver	—
`5.0.0-alpha4`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official YesWiki patch to upgrade to version 4.7.0 or later, or 5.0.0‑alpha5 or newer.
If an immediate upgrade is not possible, disable or restrict access to the Bazar entries search API, limiting it to trusted IP addresses or authenticated users.
Implement monitoring of the web application and database logs to detect anomalous SQL queries or repeated failures, and alert administrators.

Generated by OpenCVE AI on October 25, 2026 at 17:12 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.307% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877
https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api

History

Oct 26, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Title		YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
First Time appeared		Yeswiki Yeswiki yeswiki
Weaknesses		CWE-89
CPEs		cpe:2.3:a:yeswiki:yeswiki::::::::
Vendors & Products		Yeswiki Yeswiki yeswiki
References		https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877 https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}` cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'}`