CVE-2026-123489

Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext and getPrev methods pass arbitrary criteria arrays to Craft::configure without removing SQL-bearing properties such as orderBy and where. Authenticated control...