CVE-2026-123488
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 6 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, s…
- Affected
- See advisory
- Fix
- Upgrade the product to 4.18.9, 5.0.0 or 5.11.2 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
Last activity 6 Nov 2026. Patch Forecast updates every hour.