The flaw is an unauthenticated SQL injection located in the Bazar form‑import route of YesWiki’s FormManager::create() method. Prior to version 4.6.4, attackers can supply malicious input that is incorporated unvalidated into an INSERT statement, allowing them to execute arbitrary SQL and extract the full contents of the database, including the passwords stored in yeswiki_users.password.

YesWiki installations running any version earlier than 4.6.4 are susceptible. The vulnerability exists in the default YesWiki distribution and can be triggered from a public web request without authentication.

The vulnerability receives a CVSS score of 9.8, indicating critical severity. The EPSS score is 2%, and the flaw is not in the CISA KEV catalog, but its easy exploitation path and high impact make it a high‑risk target. An attacker only needs to send a crafted HTTP request to the form‑import endpoint; no user credentials or privileged access are required. Successful exploitation yields full read access to the database and sensitive credentials.