PT-2026-111412 · Pyload · Payloadcms

0Xmesbaha

·

CVE-2026-63316

·

Published

2026-10-13

·

Updated

2026-10-13

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not in" query paramethers allows an authenticated attacker to perform SQL Injection attacks.
This issue was fixed in version 3.90.0 and 4.0.0-canary.34.

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-63316

Affected Products

Payloadcms