CVE

CVE-2026-123488

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

cms

Updated Nov 11, 2026View on NVD →

S4E scanner

criticalWeb Vulnerabilities~10 seconds

Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL Injection

Craft CMS References: https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6 https://github.com/craftcms/cms/compare/4.18.8...4.18.9 https://github.com/dinosn/CVE-2026-123488-CraftCMS-Lab https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint https://nvd.nist.gov/vuln/detail/CVE-2026-123488 Remediation: Upgrade to Craft CMS 4.18.9 or 5.11.2 or later.

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: cms

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →