Craft CMS (4.0.0-4.18.9, 5.0.0-5.11.2)

Craft CMS versions 4.x before 4.18.9 and 5.x before 5.11.2 are vulnerable to SQL injection via the GraphQL eager-loading mechanism, allowing unauthenticated attackers to disclose arbitrary database content.