Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck
CVE-2026-116828YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
Medium 4.9
In plain English
A medium-severity SQL injection in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.2%top 83.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-w7cp-76pj-w4m5) vendor-advisory
- VulnCheck Advisory: YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand third-party-advisory