{"id":"CVE-2026-123488","aliases":[],"cve":{"records":[{"id":"CVE-2026-123488","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-06T00:44:37.658Z","published":"2026-11-06T15:00:50.084Z","modified":"2026-11-06T15:00:50.084Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-06T15:00:50.084Z"}],"references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-89","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.18.9"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.11.2"}]}]}]}],"prioritization":[]},"title":"Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","score":9.8,"severity":"critical","published":"2026-11-06T15:00:50.084Z","modified":"2026-11-06T15:00:50.084Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"craftcms","name":"cms","platforms":[],"versions":[{"version":"4.0.0","status":"affected","lessThan":"4.18.9","versionType":"semver"},{"version":"4.18.9","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123488"},{"vendor":"craftcms","name":"cms","platforms":[],"versions":[{"version":"5.0.0","status":"affected","lessThan":"5.11.2","versionType":"semver"},{"version":"5.11.2","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-123488"}],"remediation":[],"references":["https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6","https://www.vulncheck.com/advisories/craft-cms-4.0.0-before-4.18.9-sql-injection-via-element-search-endpoint"],"sources":[{"name":"CVE","id":"CVE-2026-123488","modified":"2026-11-06T15:00:50.084Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-123488"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-06T15:26:28.802Z","kev":{"status":"not-listed","checkedAt":"2026-11-08T03:05:30.801Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 have a SQL injection vulnerability via the element search endpoint. An attacker can exploit this weakness without authentication. The impact may include reading and writing the database.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T23:21:26.910Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-123488"}]}}