CVE-2026-104457
|
| |
|
|
Software afectado |
MYSQL |
|
|
|
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-104457 |
