CVE-2026-52763Medium· 6.5▾ SunlitYesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','w…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page. On a default install (default_write_acl='*'), this includes anonymous users, subject to the hashcash JS check on the page-edit form. Once the trigger page is saved, every subsequent view fires the injection as the SQLi is stored. Stored SQL injection is reachable through the page-edit flow, with arbitrary database read. This issue has been patched in version 4.6.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
yeswiki/yeswiki < 4.6.6Patched in:
yeswiki/yeswiki 4.6.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-52770High· 7.5YesWiki is a wiki system written in PHP
CVE-2026-52771High· 8.3YesWiki is a wiki system written in PHP
CVE-2026-52775High· 8.8YesWiki is a wiki system written in PHP
CVE-2026-52762High· 7.1YesWiki is a wiki system written in PHP
CVE-2026-52766Critical· 9.1YesWiki is a wiki system written in PHP
CVE-2026-52767High· 8.2YesWiki is a wiki system written in PHP