The "recentchanges" action ("actions/recentchanges.php") accepts a "period" argument from two disjoint parameter spaces: the URL query string ("$_GET['period']") and the action invocation "{{recentchanges period="..."}}". A whitelist at line 17 validates only the URL form against "['day','week','month']". The action-argument form takes the "else" branch at line 33 ("$dateMin = $this->GetParameter('period')") with no validation, and the value flows into "PageManager::getRecentlyChanged()" ("includes/services/PageManager.php:196"), where it is interpolated into a "WHERE time >= '...' ORDER BY time DESC" clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page via "actions/recentchanges.php:43,58" ("ComposeLinkToPage($page['tag'])"), so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page. On a default install ("default_write_acl='*'"), this includes anonymous users, subject to the hashcash JS check on the page-edit form. Once the trigger page is saved, every subsequent view fires the injection as the SQLi is stored. Stored SQL injection is reachable through the page-edit flow, with arbitrary database read.