CVE-2026-116207

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

• CWE-89

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877
• https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api

Published

Oct 25, 2026

Last Modified

Oct 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116201Snipe-IT before 8.5.0 contains a SAML assertion replay vulne…8.8
• CVE-2026-116202YesWiki before 4.7.0 contains a stored cross-site scripting …5.4
• CVE-2026-116203YesWiki before 4.7.0 contains a stored cross-site scripting …6.1
• CVE-2026-116204YesWiki before 4.7.0 contains a cross-site request forgery v…8.1
• CVE-2026-116205YesWiki before 4.7.0 contains an unauthenticated server-side…5.3
• CVE-2026-116206YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site…6.4
• CVE-2026-116208YesWiki from 4.6.2 before 4.7.0 contains a missing authoriza…8.1
• CVE-2026-11621A weakness has been identified in Dcat-Admin up to 2.2.3-bet…4.7
• CVE-2026-116210Webasyst Framework through 4.4.0 contains a cross-site reque…6.5
• CVE-2026-116211YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnera…8.2
• CVE-2026-116212Webasyst Framework through 4.4.0 contains a stored cross-sit…5.4
• CVE-2026-116213Webasyst Framework through 4.4.0 contains an arbitrary file …4.9