ghost-cve-2026-26980

CVE-2026-26980 — Ghost CMS Content API SQL 注入实验环境 通过 Content API 的 slug 过滤器排序机制，在 Ghost CMS 中实现未认证的盲 SQL 注入，允许在无需凭据的情况下从任意 Ghost 实例读取任意数据库内容。...

CVE-2026-64880 Blind SQL Injection

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-26980

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1...