Medium 6.9

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows...

CVE-2026-116820 First seen on SecPulse 08:05

Affected packages

Ecosystem	Package	Affected	Fixed
YesWiki	yeswiki	≥ 4.6.0, < 4.7.0	4.7.0

Original description The description as published by the source.

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4: Medium 6.9; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Published: Oct 27, 2026
First seen on SecPulse: 08:05
GHSA: GHSA-9vjw-qm94-65hm
CWE: CWE-215

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

SQL Injection

All

CWE-215 Yeswiki

Detection sources

NIST National Vulnerability Database09:17
GitHub Security Advisories (Global)09:32
CVE.org (CVE Program・cvelistV5)08:05