{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/yeswiki-4.6.2--version--4.7.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*","cpe:2.3:a:yeswiki:yeswiki:4.6.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-116207"},{"cvss":8.1,"id":"CVE-2026-116208"},{"cvss":8.2,"id":"CVE-2026-116211"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["YesWiki (4.6.0 \u003c= version \u003c 4.7.0)","YesWiki (5.0.0-alpha1 \u003c= version \u003c 5.0.0-alpha4)","YesWiki (4.6.2 \u003c= version \u003c 4.7.0)","YesWiki (4.5.0 \u003c= version \u003c 4.7.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application","sql-injection","cve-2026-116207","cve-2026-116211"],"_cs_type":"advisory","_cs_vendors":["YesWiki"],"content_html":"\u003cp\u003eYesWiki contains an unauthenticated SQL injection vulnerability in the SearchManager::prepareSearchRequest() method. The flaw stems from improper sanitization of field names within the Bazar entries search API. Specifically, the query and searchfields parameters are placed into backtick-quoted aliases using only mysqli_real_escape_string, which is insufficient for backtick encapsulation. This allows attackers to break out of the alias context and execute arbitrary SQL subqueries.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to read sensitive database records, including user password hashes, or perform denial-of-service attacks by injecting time-based commands such as SLEEP().\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade YesWiki to version 4.7.0 or 5.0.0-alpha4 or later to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eUntil patching is complete, restrict access to the public Bazar entries search API at the web application firewall or reverse proxy level.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to the Bazar search endpoint containing backtick characters (`) or SQL keywords commonly used for subquery injection (e.g., SELECT, UNION, SLEEP).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-25T14:33:09Z","date_published":"2026-10-25T14:31:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-yeswiki-sql-injection/","summary":"An unauthenticated SQL injection vulnerability in YesWiki versions 4.6.0-4.6.x and 5.0.0-alpha1-alpha3 allows remote attackers to perform subquery injection to extract database content or cause denial-of-service.","title":"YesWiki: Unauthenticated SQL injection in SearchManager (CVE-2026-116207)","url":"https://feed.craftedsignal.io/briefs/2026-10-yeswiki-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - YesWiki (4.6.2 \u003c= Version \u003c 4.7.0)","version":"https://jsonfeed.org/version/1.1"}