MEDIUMCVSS v3.1 4.9Vulnerability
CVE-2026-116828
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-27T03:23:14.679434+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 4.9
- Retrieved at
- 2026-10-27T03:24:29+00:00
- Score
- 4.9
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-116828
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-10-27T03:16:31+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Published at
- 2026-10-27T00:17:18.920
- Last modified
- 2026-10-27T00:17:19.157
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph