Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-63316

SQL Injection in Payload CMS

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Payload Payload CMS

Default version status: unaffected

  • 0 to < 3.90.0affected
  • 4.0.0-canary.0 to < 4.0.0-canary.34affected

References