What is GHSA-hxwq-9qc3-4972?

GHSA-hxwq-9qc3-4972 is a security advisory published by GitHub Security Advisories with Medium severity. YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from...

Which CVE IDs does GHSA-hxwq-9qc3-4972 cover?

GHSA-hxwq-9qc3-4972 covers the following CVE IDs: CVE-2026-116828. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hxwq-9qc3-4972?

GHSA-hxwq-9qc3-4972 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

GHSA-hxwq-9qc3-4972MediumCVSS 4.9

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from...

Vendor

GitHub Security Advisories

Published

October 27, 2026

Last Modified

October 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-116828 →

📋 Description

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

🔗 References (4)

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w7cp-76pj-w4m5
https://nvd.nist.gov/vuln/detail/CVE-2026-116828
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-sql-injection-via-despam-php-interval-operand
https://github.com/advisories/GHSA-hxwq-9qc3-4972