CVE-2026-116207
Critical
Description
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
SeverityCritical
CVSS9.1
Exploit probability—
Product
Yeswiki
PublishedOct 25, 2026
First seenOct 25, 2026
Weakness typeCWE-89SQL injection
How to fix
Update
- YesWiki yeswiki4.7.0, 5.0.0-alpha4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| YesWiki yeswiki | 4.6.0 ≤ v < 4.7.0, 5.0.0-alpha1 ≤ v < 5.0.0-alpha4 | 4.7.0, 5.0.0-alpha4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.