CVE-2026-116828 YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand

Versions of YesWiki prior to 4.7.0 are vulnerable to a SQL injection flaw within the despam.php component. The root cause is that while the from parameter is escaped, it is placed in an unquoted INTERVAL position , allowing for exploitation. Authenticated administrators can leverage this vulnerab...