CVE-2026-46670 Scanner
Targets the Bazar form-import endpoint; unauthenticated attackers can inject SQL to extract user credentials and database contents.
Used 2.4k times · 3.3k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-46670
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
yeswiki
Updated Sep 28, 2026View on NVD →
S4E scanner
CVE history: yeswiki
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →