ghost-cve-2026-26980

CVE-2026-26980 — Lab di SQL Injection nella Content API di Ghost CMS SQL injection blind non autenticata in Ghost CMS tramite il meccanismo di ordinamento del filtro slug della Content API, che consente letture arbitrarie del database da qualsiasi istanza Ghost senza credenziali...

CVE-2026-64880 Blind SQL Injection

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-26980

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1...