6.9
Medium
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled…
CVE-2026-116820
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.
Assessment
- CVSS
- 6.9 (v4.0)
- Severity
- Medium
- EPSS
- 0.23% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 31 October 2026
- Affected
- YesWiki
- Weakness
- CWE-215
- Assigner
- disclosure@vulncheck.com
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
At the source
References
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116820