YesWiki’s Bazar search API takes a field name, wraps it in backticks as a SQL identifier, and escapes it with mysqli_real_escape_string — a function that doesn’t touch backticks because backticks aren’t special inside a string literal.
CVE-2026-116207, CVSS 9.1, unauthenticated, in-band. One GET request. Password hashes in the response body.
Fix: 4.7.0. Seventh SQL injection finding in YesWiki this year.
🔗 https://threataft.com/articles/yeswiki-cve-2026-116207-sql-injection-preparesearchrequest
ThreatAftYesWiki 9.1: A Backtick in the Wrong Escape | ThreatAftCVE-2026-116207: unauth SQL injection in YesWiki's Bazar search API. 9.1 v3.1 / 8.8 v4.0, read-only and in-band. Fixed in 4.7.0 and 5.0.0-alpha4.