Medium severity · published Oct 26, 2026
CVE-2026-116828
YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
New
4.9
CVSS
0.2%
EPSS
No
On KEV
Description
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YE
yeswiki · YesWiki
before 4.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116828
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116828
github.com
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w7cp-76pj-w4m5
www.vulncheck.com
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-sql-injection-via-despam-php-interval-operand
More from yeswiki
9.8
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
9.8
CVE-2026-52778
YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
9.8
CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
9.8
CVE-2025-46347
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
9.8
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…