{"id":"EM-20261111-2779","url":"https://cyber.eventmonitor.net/incident/EM-20261111-2779/critical-craft-cms-vulnerability-cve-2026-123488/","type":"cve","title":"Critical Craft CMS Vulnerability (CVE-2026-123488)","subtitle":"CVE-2026-123488","subject":"CVE-2026-123488","status":"Developing","severity":"critical","affected":[],"headline":null,"born":"2026-11-11T05:27:28.000Z","firstSignal":"2026-11-06T15:17:18.133Z","lastSignal":"2026-11-11T05:27:28.000Z","updated":"2026-11-11T17:12:32.988Z","revision":2,"life":[{"status":"Born","at":"2026-11-11T05:27:28.000Z","why":"second independent source: C34 ProjectDiscovery nuclei-templates"},{"status":"Developing","at":"2026-11-11T05:27:28.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-06T15:17:18.133Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-11T00:00:00.000Z","what":"Source joined: C30 VulnCheck KEV"},{"at":"2026-11-11T05:27:28.000Z","what":"Born: second source, C34 ProjectDiscovery nuclei-templates. Page EM-20261111-2779 created."}],"stages":[{"name":"Disclosed","at":"2026-11-06T15:17:18.133Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-06T15:17:18.133Z","detail":"CVSS 9.3 · EPSS 0.5%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-06T15:17:18.133Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":4,"title":"CVE-2026-123488 (CVSS 9.3)","text":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123488"},{"at":"2026-11-11T00:00:00.000Z","source":"C30","sourceName":"VulnCheck KEV","role":"Research & News","severity":3,"title":"CVE-2026-123488 known exploited (VulnCheck KEV): craftcms Craft CMS Improper Neutralization of Special Elements used in an SQL Command","text":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and…","url":"https://vulncheck.com/browse/cve/CVE-2026-123488"},{"at":"2026-11-11T05:27:28.000Z","source":"C34","sourceName":"ProjectDiscovery nuclei-templates","role":"Research & News","severity":2,"title":"ProjectDiscovery nuclei-templates: Merge pull request #17751 from projectdiscovery/Akokonunes-patch-11","text":"Merge pull request #17751 from projectdiscovery/Akokonunes-patch-11 Create CVE-2026-123488.yaml - Craft CMS < 4.18.9, < 5.11.2 - Unauthenticated SQL Injection","url":"https://github.com/projectdiscovery/nuclei-templates/commit/f3f0448344e4e3083f387f44f7235e1355debdd2"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-06T15:17:18.133","score":9.3,"severity":"CRITICAL","desc":"Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and…","product":"","seen":1794276929232},"kev":null,"epss":{"epss":0.00476,"pct":0.41429,"at":1794377853059},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}