CVE-2026-52763

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page. On a default install (default_write_acl='*'), this includes anonymous users, subject to the hashcash JS check on the page-edit form. Once the trigger page is saved, every subsequent view fires the injection as the SQLi is stored. Stored SQL injection is reachable through the page-edit flow, with arbitrary database read. This issue has been patched in version 4.6.6.

• CWE-89
• CWE-1287

• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89v6-j5x6-cmj3

Published

Sep 5, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52758Ghidra before 12.1 contains a SQL injection vulnerability in…8.8
• CVE-2026-52759Ghidra before 12.1.1 contains an uncontrolled memory allocat…6.7
• CVE-2026-5276Insufficient policy enforcement in WebUSB in Google Chrome p…6.5
• CVE-2026-52760Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-52761ModSecurity is an open source, cross platform web applicatio…5.3
• CVE-2026-52762YesWiki is a wiki system written in PHP. Prior to version 4.…7.1
• CVE-2026-52766YesWiki is a wiki system written in PHP. Prior to version 4.…9.1
• CVE-2026-52767YesWiki is a wiki system written in PHP. From version 4.6.2 …8.2
• CVE-2026-52769YesWiki is a wiki system written in PHP. From version 4.6.2 …8.3
• CVE-2026-5277Integer overflow in ANGLE in Google Chrome on Windows prior …7.5
• CVE-2026-52770YesWiki is a wiki system written in PHP. Prior to version 4.…7.5
• CVE-2026-52771YesWiki is a wiki system written in PHP. From version 4.2.0 …8.3