CVE-2026-46670
CriticalCVSS 9.8Summary
YesWiki before 4.6.4 has an unauthenticated SQL injection in the Bazar form-import path, allowing any visitor to inject arbitrary SQL into an INSERT statement and read the full database, including password hashes.
Risk Assessment
An attacker can gain full database access, including user passwords, leading to account and data compromise.
Recommendation
Upgrade YesWiki to version 4.6.4 or later. Restrict access to import forms and monitor database logs.
Original NVD description (English source)
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.