CVE-2026-116828: YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
Published Oct 26, 2026
·Updated
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.
Affected Software
1 affected component
YesWiki YesWiki<4.7.0
Event History
Oct 26, 2026
CVE Published
via MITRE·11:05 PM
Data Sourced
via MITRE·11:05 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Exploitation requires an authenticated YesWiki administrator. The attacker submits a crafted value in the from POST parameter handled by despam.php.
2
What information could be exposed?
An administrator-level attacker can perform blind reads of the database. The disclosed impact includes access to user password hashes.
3
Which versions are affected?
YesWiki versions before 4.7.0 are affected. Upgrading to 4.7.0 or later removes the affected version range described in the advisory.