CVE-2026-116211GHSA-wjf7-hrf3-9gcx
YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
YesWiki yeswiki
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 4.7.0yeswikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @thehackerwire.bsky.social: 🟠 CVE-2026-116211 - High (8.2) YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where ... https://www.thehackerwire.com/vulnerability/CVE-Bluesky: CVE posts, 25 Oct 2026
- @cve.skyfleet.blue: CVE-2026-116211 - YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create CVE ID : CVE-2026-116211 Published : Oct. 25, 2026, 1:20 p.m. | 39 minutes ago DBluesky: CVE posts, 25 Oct 2026
Description
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.
Text from CVE List
Affected versions 2
- yeswikiaffected: 4.5.0 before 4.7.0CVE List
- yeswikiunaffected: 4.7.0CVE List