Skip to content
Threat Feed

Product

Yeswiki/Yeswiki (< 4.6.4)

1 brief RSS
critical advisory

YesWiki Unauthenticated SQL Injection Vulnerability

YesWiki versions prior to 4.6.4 are vulnerable to an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`), allowing an unauthenticated attacker to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes (CVE-2026-46670).

yeswiki/yeswiki sqli web-application yeswiki
2r 1t