Skip to content
SQL Injection Vulnerability in YesWiki Disclosed

SQL Injection Vulnerability in YesWiki Disclosed

First seen 26 Oct 2026, 06:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 07:41 UTC
  • •CVE-2026-116207 is a critical SQL injection vulnerability in YesWiki.
  • •Unauthenticated attackers can exploit this flaw via the public Bazar entries API.
  • •Users are urged to upgrade to patched versions to mitigate risks.

A SQL injection vulnerability, CVE-2026-116207, has been identified in YesWiki versions 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4. The flaw allows unauthenticated attackers to exploit the public Bazar entries API by injecting subqueries through backtick-quoted field names. This vulnerability can lead to the exposure of sensitive data, including user password hashes, or cause denial of service by exhausting database threads. The CVSS score for this vulnerability is 9.1, indicating a severity level. No public proof-of-concept or evidence of exploitation has been reported as of now. Users are advised to upgrade to version 4.7.0 or later for the 4.x branch and 5.0.0-alpha4 or later for the 5.0.0 branch. As an interim measure, restricting access to the public Bazar entries API is recommended until a patch can be applied.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-25
CVE-2026-116207 published
YesWiki disclosed a critical SQL injection vulnerability affecting multiple versions.
Feedly
2026-10-26
Details on exploitation method released
ThreatAft published an analysis detailing how the SQL injection can be exploited through crafted API requests.
threataft.com
2026-10-26
SecurityFocus reports on vulnerability
SecurityFocus confirmed the SQL injection vulnerability and its potential impact on user data.
www.securityfocus.com

More articles in this cluster (5)

Following this threat?

Track CVE-2026-116207 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

Which versions of YesWiki are affected?
YesWiki versions 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 are affected.
Is there a patch available?
Yes, users should upgrade to version 4.7.0 or later for the 4.x branch and 5.0.0-alpha4 or later for the 5.0.0 branch.
Has this vulnerability been exploited in the wild?
No evidence of exploitation has been reported as of now.