CVE-2026-104457

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-104457

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104457.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-104457

Aliases

GHSA-p87r-f4x4-8r4g

Published

2026-10-02T11:38:27Z

Modified

2026-10-04T02:46:36Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter

Details

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-89"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104457.json"
}

References

Affected packages

Git / github.com/yeswiki/yeswiki

Affected ranges

Type

GIT

Repo

https://github.com/yeswiki/yeswiki

Events

Introduced

Fixed

07120ed8971047f504f7ec78060828f1895f475f

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.6.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v4.*

v4.1.0

v4.1.5

v4.2.0

v4.2.1

v4.2.2

v4.3.0

v4.3.1

v4.4.0

v4.4.1

v4.4.2

v4.4.3

v4.5.1

v4.5.2

v4.5.3

v4.5.4

v4.5.5

v4.6.0

v4.6.2

v4.6.3

v4.6.4

v4.6.5

v4.6.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-104457.json"