Is CVE-2026-104457 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104457?

CVE-2026-104457 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-104457

Description

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.