CVE-2026-41143

HIGH

YesWiki vulnerable to authenticated SQL Injection via id_fiche in EntryManager::formatDataBeforeSave()

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-41143 has a selected CVSS score of 8.8 (high).

Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data['id_fiche'] value (sourced from $_POST['id_fiche']) is concatenated directly into a raw SQL query without any sanitization or parameterization. This issue has been patched in version 4.6.1.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 7, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

yeswiki

Browse YesWiki / yeswiki
CVE List< 4.6.1affected

yeswiki/yeswiki

Browse Packagist / yeswiki/yeswiki
GitHub AdvisoryBefore 4.6.1 · Fixed in 4.6.1affected

References

4