Is CVE-2026-104462 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104462?

CVE-2026-104462 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-104462

Description

YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.