{"id":"CVE-2026-104462","published":"2026-10-02T12:17:18.467","lastModified":"2026-10-02T15:17:08.050","description":"YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-p9rm-p6pp-8m8c","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-sql-injection-via-nuagetag-tags-parameter","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-p9rm-p6pp-8m8c","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-p9rm-p6pp-8m8c","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-p9rm-p6pp-8m8c","tags":[]}],"hasPoc":true,"ai":{"summary":"YesWiki before 4.6.7 has an SQL injection vulnerability in its Bazar nuagetag action that allows attackers with page-write access to inject malicious SQL queries. This can lead to unauthorized data exposure including password hashes and arbitrary table data.","exploitability":"Exploitation is relatively straightforward for attackers with page-write access, requiring only a single crafted nuagetag tag with a backslash to break quote parity and inject a UNION subquery.","blast_radius":"The vulnerability affects default installations where unauthenticated users can write pages, potentially exposing sensitive data from the database including user credentials and application data.","remediation":"Upgrade to YesWiki 4.6.7 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","credential-exfiltration","unauthenticated-access"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:03:12.735Z"}}