CVE-2026-116828

MEDIUM 4.9

YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand

CVSS Score

4.9

EPSS Score

0.0%

EPSS Percentile

0th

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

CWE	CWE-89
Vendor	yeswiki
Product	yeswiki
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for yeswiki yeswiki

Be the first to know when new medium vulnerabilities affecting yeswiki yeswiki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

YesWiki / yeswiki

0 < 4.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w7cp-76pj-w4m5 vulncheck.com: https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-sql-injection-via-despam-php-interval-operand