ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-104460

YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch

CVSS 4.0 8.7 HIGHCVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-104460

Published

YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-104460

Published

yeswiki

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "YesWiki",
                    "product": "yeswiki",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "4.6.7"
                        },
                        {
                            "version": "4.6.7",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON