CVE-2026-41143

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data['id_fiche'] value (sourced from $_POST['id_fiche']) is concatenated directly into a raw SQL query without any sanitization or parameterization. This issue has been patched in version 4.6.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: May 7, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-411449.8F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to versio CVE-2026-411458.2MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an au CVE-2026-411468.7facil.io is a C micro-framework for web applications. Prior to commit 5128747363055201d3ecf0e29bf0a961703c9fa0, `fio_json_parse` can enter a CVE-2026-411478.7NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability cause CVE-2026-411485.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and prior, in additi CVE-2026-411495.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Versions 10.9.5 and earlier, as well CVE-2026-41153.7A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the component Ed25519 Sign CVE-2026-411505.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, there i CVE-2026-411539.8In JetBrains Junie before 252.549.29 command execution was possible via malicious project file CVE-2026-411547.8Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing page CVE-2026-411555.5An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secure memory allocations CVE-2026-411567.7Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a wri