The vulnerability is an SQL injection flaw present in the public Bazar entry‑listing APIs of YesWiki. For fields that are defined as numeric, the software escapes the filter value but fails to quote or validate it, allowing an attacker to inject boolean SQL expressions. An unauthenticated user can manipulate the query filter in a request and determine whether specific database rows are returned, effectively exposing database contents. The weakness is a classic injection flaw, documented as CWE‑89.

YesWiki installations running any version prior to 4.6.6 and exposing the public Bazar entry‑listing APIs are impacted. This includes all hosts that have the default API endpoints accessible without authentication, regardless of the site’s overall access controls.

The vulnerability carries a CVSS score of 7.5, indicating high severity. While the EPSS score is not provided, the absence does not negate the risk; the flaw remains fully exploitable by any unauthenticated user who can reach the API. The issue is not in CISA’s KEV catalog, but its potential for data exposure and the lack of required privileges make it a significant threat. Exploitation would require only a crafted HTTP request to the vulnerable API; further steps are unnecessary as the flaw does not grant arbitrary code execution or elevation of privileges.