CVE-2026-123488: critical vulnerability in craftcms cms
Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
45Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.3
from disclosure to weaponsame day
Published on NVDNov 6
1st PoCNov 6
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
craftcms · cmspublic PoCs found — 1
githubgithub.com/fixedbyreboot/CVE-2026-123488-POC★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — craftcms cms
In the same product, most dangerous first.
CVE-2025-32432CRITICALCraft CMS Allows Remote Code ExecutionEPSS 99.8%KEVCVE-2024-56145CRITICALRCE when PHP `register_argc_argv` config setting is enabled in craftcms/cmsEPSS 97.5%KEVCVE-2025-23209HIGHPotential RCE with a compromised security key in craft/cmsEPSS 21.6%KEVCVE-2023-41892CRITICALCraft CMS Remote Code Execution vulnerabilityEPSS 94.2%CVE-2026-32267HIGHCraft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()EPSS 9.6%CVE-2023-40035HIGHCraft CMS vulnerable to Remote Code Execution via validatePath bypassEPSS 2.3%