Medium severity5.3NVD Advisory· Published Oct 27, 2026· Updated Oct 27, 2026

CVE-2026-116820

Description

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.

Affected products

Yeswiki/Yeswikillm-fuzzy
Range: 4.6.0 <= x < 4.7.0

Patches

Vulnerability mechanics

References

github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwmnvd
www.vulncheck.com/advisories/yeswiki-from-4.6.0-before-4.7.0-sql-query-disclosure-via-showreq-parameternvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000