Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: craftcms cms 4.18.9 Clear all filters
TI-2026-85953 CVE-2026-123491 · GHSA-6534-m2vq-3r2h

SQL injection in Craft CMS GraphQL lets attackers read database

Priority MEDIUM 44

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criter…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00291 Published 2026-11-06 Fixed in 4.18.9, 5.11.2 CWE-89
TI-2026-85951 CVE-2026-123489 · GHSA-w2f7-mc8w-f637

Blind SQL injection in Craft CMS getNext and getPrev criteria

Priority LOW 31

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00239 Published 2026-11-06 Fixed in 4.18.9, 5.11.2 CWE-89
TI-2026-85950 CVE-2026-123488 · GHSA-qvg8-69ff-cf67

SQL injection in Craft CMS element search endpoint

Priority MEDIUM 41

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00476 Published 2026-11-06 Fixed in 4.18.9, 5.11.2 CWE-89