YesWiki’s recentchanges action contains a stored SQL injection flaw. The period argument, supplied through the action‑argument form, bypasses the intended whitelist and is concatenated directly into a SQL WHERE clause. A user who can edit a page endows the database with the malicious payload, which is executed each time the page is viewed. This allows an attacker to read any table in the YesWiki database. The weakness stems from improper input validation (CWE‑1287) and a lack of query parameterization (CWE‑89).

All YesWiki installations running a version older than 4.6.6, particularly default installations that grant anonymous users write access and enable the recentchanges action, are affected.

The CVSS score of 6.5 signals moderate severity. The EPSS score is not available, so the prevalence of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Attacking the flaw requires the ability to save a page, which on a default configuration is possible for anonymous users after passing a hashcash check. When the payload is stored, any subsequent visitor to the page causes the injection to run, enabling arbitrary database reads through a client‑side web interface. The attack vector is web‑based, and the impact is potential data disclosure.