CVE-2026-46670: fallo crítico en yeswiki
YesWiki: Unauthenticated SQL Injection
Publicada el · Actualizada el
43Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 9.8epss 2.0%
probabilidad de explotación
2.0%top 20% de las CVE
explotación observada
noninguna fuente lo reporta
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
YesWiki · yeswikiCVEs relacionadas — yeswiki
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.5%CVE-2025-46347MEDIUMYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionEPSS 1.0%CVE-2026-52778CRITICALYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)EPSS 0.8%CVE-2026-52762HIGHYesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic TemplatesEPSS 0.8%CVE-2026-52774MEDIUMReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiEPSS 0.7%CVE-2025-46348CRITICALYesWiki Vulnerable to Unauthenticated Site Backup Creation and DownloadEPSS 0.7%