CVE-2026-123489

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123489 Craft CMS 4.0.0 before 4.18.9 Blind SQL Injection via getNext/getPrev Criteria

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123489

Craft CMS versions 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 are vulnerable to a blind SQL injection vulnerability. The root cause is that the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without stripping SQL-bearing properties like order...

EUVD-2026-118289

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...

CVE-2026-123489: craftcms cms: Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the…

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...