Medium 6.9

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from...

CVE-2026-116828 First seen on SecPulse 08:05

Affected packages

Ecosystem	Package	Affected	Fixed
YesWiki	yeswiki	< 4.7.0	4.7.0

Original description The description as published by the source.

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 4.9; CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4: Medium 6.9; CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Published: Oct 27, 2026
First seen on SecPulse: 08:05
GHSA: GHSA-hxwq-9qc3-4972
CWE: CWE-89

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

PHP

Attack Types

SQL Injection

CWE

CWE-89

All

Yeswiki

Detection sources

NIST National Vulnerability Database09:17
GitHub Security Advisories (Global)09:32
CVE.org (CVE Program・cvelistV5)08:05