ghost-cve-2026-26980

CVE-2026-26980 — Ghost CMS Content API SQL 인젝션 랩 Ghost CMS의 Content API 슬러그 필터 정렬 메커니즘을 통한 인증되지 않은 블라인드 SQL 인젝션으로, 자격 증명 없이 모든 Ghost 인스턴스에서 임의의 데이터베이스 읽기가 가능합니다. | ---|--- CVE| CVE-2026-26980 Advisory| GHSA-w52v-v783-gw97 CVSS| 9.4 Critical CWE| CWE-89 SQL Injection 영향 버전| Ghost 3.24.0 -- 6.19.0 ...

CVE-2026-64880 Blind SQL Injection

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-26980

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1...