{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-123488/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-123488"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Craft CMS (4.0.0 through 4.18.8)","Craft CMS (5.0.0 through 5.11.1)"],"_cs_severities":["critical"],"_cs_tags":["web-application","sql-injection","cve-2026-123488"],"_cs_type":"advisory","_cs_vendors":["Craft CMS"],"content_html":"\u003cp\u003eCraft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 are vulnerable to an unauthenticated SQL injection flaw in the element search endpoint. The vulnerability exists due to improper sanitization of the 'attribute' parameter in combination with emulated PDO prepares, which permits stacked SQL queries.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can perform unauthorized read and write operations on the database. This allows for full database compromise, including the ability to overwrite user password hashes or modify administrative flags within the users table to gain persistent administrator access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Craft CMS 4.x installations to version 4.18.9 or later.\u003c/li\u003e\n\u003cli\u003eUpgrade Craft CMS 5.x installations to version 5.11.2 or later.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for anomalous requests to the element search endpoint containing non-standard characters typically used for SQL injection, such as semicolons, comment markers, or SQL keywords in the 'attribute' query parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:23:34Z","date_published":"2026-11-06T17:23:34Z","id":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli/","summary":"Craft CMS versions 4.0.0 through 4.18.8 and 5.0.0 through 5.11.1 contain an unauthenticated SQL injection vulnerability via the element search endpoint that enables remote attackers to perform unauthorized database operations and escalate privileges.","title":"Craft CMS: Unauthenticated SQL injection (CVE-2026-123488)","url":"https://feed.craftedsignal.io/briefs/2026-11-craft-cms-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-123488","version":"https://jsonfeed.org/version/1.1"}