CVE-2026-26980-Ghost-CMS-Api

CVE-2026-26980 Ghost CMS SQL Injection PoC Этот репозиторий содержит PoC-инструмент на Go для демонстрации и проверки уязвимости SQL-инъекции в Content API Ghost CMS, описанной в CVE-2026-26980. Реализация основана на алгоритме эксплуатации, реализованном в основном Go-файле, и предназначена...

Ghost CMS Content API - SQL Injection

Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload. id: CVE-2026-26980 info: name: Ghost CMS Content API - SQL Injection author:...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Обзор CVE-2026-26980 — это неаутентифицированная SQL-инъекция в TryGhost Ghost CMS Content API. Уязвимый путь доступен через логику...

ghost-cve-2026-26980

CVE-2026-26980 — SQL-инъекция в Content API Ghost CMS лабораторная работа Неаутентифицированная слепая SQL-инъекция в Ghost CMS через механизм сортировки фильтра slug в Content API, позволяющая произвольное чтение базы данных из любого экземпляра Ghost без учётных данных. | ---|--- CVE|...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

EUVD-2026-90665

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

CVE-2026-103272

Ghost versions from 2.10.0 before 6.63.0 are affected by a staff enumeration vulnerability within the content API . This flaw allows unauthenticated attackers to leak sensitive user data by observing discrepancies in API metadata responses . While the vulnerability allows for the enumeration of s...

CVE-2026-103272 Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

Ghost versions from 2.10.0 before 6.63.0 contain a staff enumeration vulnerability in the content API that allows unauthenticated attackers to leak user data. Attackers can observe discrepancies in API metadata responses to enumerate staff members and extract sensitive information without...

EUVD-2026-90664

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-103271

Ghost versions from 4.0.0 before 6.63.0 are vulnerable to a content API vulnerability that enables unauthenticated visitors to bypass content restrictions. Attackers can directly query the content API to retrieve gated post content without providing any authentication. No specific exploit details...

CVE-2026-103271 Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 PoC d'injection SQL dans l'API de contenu de TryGhost Ghost CMS ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Présentation CVE-2026-26980 est une vulnérabilité d'injection SQL non authentifiée dans l'API de contenu de TryGhost...

CVE-2025-8110-gogs-poc

CVE-2025-8110 — Écriture arbitraire de fichier dans Gogs PoC Preuve de concept pour une écriture arbitraire de fichier authentifiée dans Gogs. En poussant un dépôt qui contient un lien symbolique pointant à l'extérieur du dépôt, puis en mettant à jour le contenu de ce lien via l'API, un utilisate...

CVE-2026-27886-check

Outil d'évaluation de vulnérabilité CVE-2026-27886 Détectez en toute sécurité si une instance Strapi est vulnérable à CVE-2026-27886 sans effectuer l'intégralité de la chaîne de prise de contrôle de compte. Consultez l'article complet sur le blog de Bishop Fox. Description CVE-2026-27886 est un...

CVE-2026-26980

CVE-2026-26980 — 👻 Ghost CMS: неаутентифицированная SQL-инъекция через Content API Уязвимость SQL-инъекции в Content API Ghost позволяла неаутентифицированным злоумышленникам читать произвольные данные из базы данных. | ---|--- CVE| CVE-2026-26980 CVSS| 9.4 критический Затронутые версии| Ghost =...

CVE-2026-26980-PoC

CVE-2026-26980 — Слепая SQL-инъекция в Content API Ghost CMS Затронутые версии: Ghost 3.24.0 – 6.19.0 Исправлено в: Ghost 6.19.1 Требуется авторизация: Нет — ключ Content API является публичным Воздействие: Неавторизованное чтение всей базы данных учётные данные, ключи API Уязвимость...