CVE-2026-41143 - Vulnerability Analysis

Overview

YesWiki bazar module < 4.6.1 contains a SQL injection caused by unsanitized concatenation of $_POST['id_fiche'] in tools/bazar/services/EntryManager.php, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted POST request.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or full database compromise.

Mitigation

Upgrade to version 4.6.1 or later.

References

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f58v-p6j9-24c2
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner