{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115934", "assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "state": "PUBLISHED", "assignerShortName": "Hackrate", "dateReserved": "2026-10-23T21:23:17.389Z", "datePublished": "2026-11-09T22:57:57.368Z", "dateUpdated": "2026-11-09T23:06:37.426Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "shortName": "Hackrate", "dateUpdated": "2026-11-09T23:06:37.426Z"}, "title": "SQL injection leading to privilege escalation", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}], "affected": [{"vendor": "craftcms", "product": "cms", "collectionURL": "https://packagist.org", "packageName": "craftcms/cms", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.11.2", "versionType": "semver"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.18.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.11.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.18.9"}]}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated SQL injection can occur on the front end of any site that uses\u00a0craft.search\u00a0to perform a search, allowing stacked query execution and enabling escalation to an administrator.\n\n\n\nNote that this only affects MySQL/MariaDB.\n\nImpact * SQL injection \u2014 The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.\n * Privilege escalation to administrator \u2014 The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account\u2019s password hash.\n\n\n\n\nUpdate to the patched versions (4.18.9 and 5.11.2) to get the fix.\n\n\n\nIf you cannot update immediately, you can block front-end requests with\u00a0%5Battribute%5D\u00a0and\u00a0[attribute]\u00a0anywhere in the query string as a temporary mitigation.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An unauthenticated SQL injection can occur on the front end of any site that uses&nbsp;<code>craft.search</code>&nbsp;to perform a search, allowing stacked query execution and enabling escalation to an administrator.</p><p>Note that this only affects MySQL/MariaDB.</p><h3>Impact</h3><ul><li>SQL injection \u2014 The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.</li><li>Privilege escalation to administrator \u2014 The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account\u2019s password hash.</li></ul><p>Update to the patched versions (4.18.9 and 5.11.2) to get the fix.</p><p>If you cannot update immediately, you can block front-end requests with&nbsp;<code>%5Battribute%5D</code>&nbsp;and&nbsp;<code>[attribute]</code>&nbsp;anywhere in the query string as a temporary mitigation.</p>"}]}], "references": [{"url": "https://www.hckrt.com/hacktivity/HCKRT-Y64NY8", "tags": ["third-party-advisory", "technical-description", "mitigation"]}, {"url": "https://github.com/craftcms/cms/releases/tag/5.11.2", "tags": ["release-notes"]}, {"url": "https://github.com/craftcms/cms", "tags": ["product"]}, {"url": "https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "ATTACKED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "Update to the patched versions (4.18.9 and 5.11.2) to get the fix.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to the patched versions (4.18.9 and 5.11.2) to get the fix."}]}], "exploits": [{"lang": "en", "value": "We're seeing exploit activity around it.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "We're seeing exploit activity around it."}]}], "credits": [{"lang": "en", "value": "@b1ue0cean", "type": "reporter"}, {"lang": "en", "value": "Hackrate", "type": "coordinator"}], "source": {"advisory": "GHSA-9c4j-cjw3-r3xx", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "packageName": "craftcms/cms", "product": "cms", "vendor": "craftcms", "versions": [{"lessThan": "5.11.2", "status": "affected", "version": "5.0.0", "versionType": "semver"}, {"lessThan": "4.18.9", "status": "affected", "version": "4.0.0", "versionType": "semver"}]}], "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An unauthenticated SQL injection can occur on the front end of any site that uses\u00a0craft.search\u00a0to perform a search, allowing stacked query execution and enabling escalation to an administrator.\n\n\n\nNote that this only affects MySQL/MariaDB.\n\nImpact * SQL injection \u2014 The attribute parameter is concatenated into the query unsanitized, and because PDO runs with emulated prepares, stacked statements execute. This gives unauthenticated read and write access to the application database.\n * Privilege escalation to administrator \u2014 The write primitive was used to set the admin flag on user ID 1 in the users table, confirmed by reading the value back. Craft short-circuits its permission checks on this single column, so no further changes were needed. The same primitive can overwrite any account\u2019s password hash.\n\n\n\n\nUpdate to the patched versions (4.18.9 and 5.11.2) to get the fix.\n\n\n\nIf you cannot update immediately, you can block front-end requests with\u00a0%5Battribute%5D\u00a0and\u00a0[attribute]\u00a0anywhere in the query string as a temporary mitigation."}], "id": "CVE-2026-115934", "lastModified": "2026-11-09T23:17:12.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "ATTACKED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "type": "Secondary"}]}, "published": "2026-11-09T23:17:12.470", "references": [{"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/craftcms/cms"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/craftcms/cms/releases/tag/5.11.2"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://github.com/craftcms/cms/security/advisories/GHSA-qcvp-ggx3-97r6"}, {"source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "url": "https://www.hckrt.com/hacktivity/HCKRT-Y64NY8"}], "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.11.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.18.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "craftcms"}, "product": "cms", "vendor": "craftcms"}], "created": "2026-11-10T00:30:20.398130+00:00", "updated": "2026-11-10T01:00:12.278584+00:00", "vendors": ["craftcms", "craftcms$PRODUCT$cms"]}