SQL Injection Vulnerability in YesWiki Product by YesWiki

CVE-2026-116211

What is CVE-2026-116211?

YesWiki versions 4.5.0 and earlier before 4.7.0 are susceptible to an SQL injection vulnerability found in the PageManager::save() function. This issue arises from the unescaped concatenation of the date_maj_fiche field in an entry-creation request into an INSERT statement. This flaw can be exploited by unauthenticated attackers on default installations to execute sub-SELECT statements against the wiki_users database, enabling them to extract hashed passwords and potentially compromise user accounts.

References