CVE-2026-63316

Name of the Vulnerable Software and Affected Versions Payload CMS versions prior to 3.90.0 Payload CMS versions prior to 4.0.0-canary.34

Description An authenticated attacker can perform SQL Injection attacks due to improper neutralization of user input provided to the in and not in query parameters. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

Recommendations Update to version 3.90.0. Update to version 4.0.0-canary.34. Restrict the use of the in and not in query parameters as a temporary mitigation measure.