What is the CVSS score of CVE-2026-41143?

CVE-2026-41143 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of YesWiki are affected by CVE-2026-41143?

CVE-2026-41143 is a high-severity SQL injection vulnerability in YesWiki's bazar module that allows authenticated users to execute arbitrary database queries, potentially exposing credentials and…. A patch is available.

YesWiki CVE-2026-41143

Q: How to fix or mitigate CVE-2026-41143?

Within 24 hours: Inventory all YesWiki installations and confirm versions currently deployed; determine if any instances expose the /api/entries/{formId} endpoint to untrusted authenticated users. Within 7 days: Upgrade YesWiki to version 4.6.1 or later; test the upgrade in a staging environment before production deployment. Within 30 days: Conduct a database audit to identify any unauthorized access logs or anomalous queries during the window of exposure; review access controls to restrict bazar module API endpoints to trusted users only.

EUVD-2026-28312 HIGH

SQL Injection (CWE-89)

2026-05-07 GitHub_M

GHSA-f58v-p6j9-24c2

PHP SQLi

8.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 07, 2026 - 07:01 EUVD

Source Code Evidence Fetched

May 07, 2026 - 05:47 vuln.today

Analysis Generated

May 07, 2026 - 05:47 vuln.today

CVE Published

May 07, 2026 - 05:08 nvd

HIGH 8.8

DescriptionNVD

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data['id_fiche'] value (sourced from $_POST['id_fiche']) is concatenated directly into a raw SQL query without any sanitization or parameterization. This issue has been patched in version 4.6.1.

AnalysisAI

{formId} endpoint to dump database contents, extract credentials, or manipulate data. Time-based blind SQLi confirmed via SLEEP() injection with 3-second delays, and error-based extraction confirmed via extractvalue() technique. …

RemediationAI

{formId} endpoint to untrusted authenticated users. Within 7 days: Upgrade YesWiki to version 4.6.1 or later; test the upgrade in a staging environment before production deployment. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-41143 vulnerability details – vuln.today

Back

YesWiki CVE-2026-41143

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code