CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which…
- Risk score
- 60/100
- CVSS
- 8.6 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 2 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.6.7 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.6 high
- Remotely exploitable without logging in
References
Original description
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
Last activity 2 Oct 2026. Patch Forecast updates every hour.