critical9.1
CVE-2026-116207
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(…
Impact
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Affected products
| Product | Affected versions |
|---|---|
| YesWiki 4.6.0 | before 4.7.0 |
| 5.0.0-Alpha1 | before 5.0.0-alpha4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.