---
id: CVE-2026-116828
title: YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
summary: >-
  YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php
  where the from parameter is escaped but placed in an unquoted INTERVAL
  position. Authenticated administrators can inject SQL via the from POST
  parameter to perform…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki < 4.7.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T23:05:52.662Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116828'
references:
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w7cp-76pj-w4m5'
    label: GitHub Security Advisory (GHSA-w7cp-76pj-w4m5)
  - url: >-
      https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-sql-injection-via-despam-php-interval-operand
    label: >-
      VulnCheck Advisory: YesWiki before 4.7.0 SQL Injection via despam.php
      INTERVAL operand
tags:
  - cve.org
epss: 0.0025
epssPercentile: 0.16292
ingestedAt: '2026-10-27T16:11:59.147Z'
---

## Overview

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

## Affected

- `yeswiki < 4.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.