CVE-2026-116820

5.3 MEDIUMpublic exploit available

Published 2026-10-27 · Updated 2026-10-27

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-215

Public exploit & PoC references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwm

All references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwm
https://www.vulncheck.com/advisories/yeswiki-from-4.6.0-before-4.7.0-sql-query-disclosure-via-showreq-parameter

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2026-102628
MEDIUMCVE-2026-112190PoC
MEDIUMCVE-2026-20543
UNSCOREDCVE-2026-22061

Related by shared AI tags and CWE weakness class. Browse the full archive.