CVE-2026-116211
High · 8.2CVSS
8.2
EPSS
0.3%
Published
Oct 25, 2026
CISA due date
—
The record
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
- CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
- CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
- CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
- CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
- CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
- CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
- CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89