What is CVE-2026-52770?

CVE-2026-52770 is a high-severity vulnerability, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-09-05.

How severe is CVE-2026-52770?

High severity. CVSS v3 base score is 7.5 out of 10.

CVE-2026-52770

CVE-2026-52770

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric query / queries filters. For Bazar fields whose value structure is numeric, YesWiki escapes the attacker-controlled filter value but inserts it into SQL without quotes or numeric validation. An unauthenticated attacker can inject boolean SQL expressions and infer database contents from whether entries are returned. This issue has been patched in version 4.6.6.

Vulnerability class: SQL Injection

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Weakness classification (CWE)

CWE-89 — SQL Injection

References

Frequently asked questions

What is CVE-2026-52770?: CVE-2026-52770 is a high-severity vulnerability, classified under SQL Injection. CVSS score: 7.5/10. Published 2026-09-05.
How severe is CVE-2026-52770?: High severity. CVSS v3 base score is 7.5 out of 10.