CVE-2026-26980-Ghost-CMS-Api

CVE-2026-26980 PoC de Inyección SQL en Ghost CMS Este repositorio contiene una herramienta de prueba de concepto basada en Go para demostrar y validar la vulnerabilidad de inyección SQL en la API de Contenido de Ghost CMS descrita por CVE-2026-26980. La implementación se basa en el flujo de...

Ghost CMS Content API - SQL Injection

Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload. id: CVE-2026-26980 info: name: Ghost CMS Content API - SQL Injection author:...

ghost-cve-2026-26980

CVE-2026-26980 — Laboratorio de Inyección SQL en la Content API de Ghost CMS Inyección SQL ciega no autenticada en Ghost CMS a través del mecanismo de ordenación del filtro de slug de la Content API, que permite lecturas arbitrarias de la base de datos desde cualquier instancia de Ghost sin...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 PoC de inyección SQL en Content API de TryGhost Ghost CMS ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Descripción general CVE-2026-26980 es una vulnerabilidad de inyección SQL no autenticada en la Content API de TryGhost Ghost...

CVE-2025-8110-gogs-poc

CVE-2025-8110 — Gogs 任意文件写入 PoC 针对 Gogs 中已验证用户任意文件写入的概念验证。 通过推送包含指向仓库外部的符号链接的仓库，然后通过 API 更新该链接的内容，已验证用户可以以运行 Gogs 账户的权限覆盖主机上的文件。 仅限授权测试和教育用途。 仅在您拥有或已获得明确书面许可的系统上运行此程序。您对使用方式负责。 工作原理 1. 使用现有账户向 Gogs 进行身份验证。 2. 从用户设置生成应用程序（API）令牌。 3. 创建一个仓库。 4. 添加一个符号链接（maliciouslink - /path/on/host）并推送。 5. 向...

CVE-2026-27886-check

Herramienta de Evaluación de Vulnerabilidad CVE-2026-27886 Detecte de forma segura si una instancia de Strapi es vulnerable a CVE-2026-27886 sin realizar la cadena completa de apropiación de cuentas. Consulte el artículo completo en el blog de Bishop Fox. Descripción CVE-2026-27886 es un bypass d...

CVE-2026-26980

CVE-2026-26980 — 👻 Ghost CMS Inyección SQL no autenticada vía Content API Una vulnerabilidad de inyección SQL existía en la API de contenido de Ghost que permitía a atacantes no autenticados leer datos arbitrarios de la base de datos...

CVE-2026-26980-PoC

CVE-2026-26980 — Ghost CMS Content API Blind SQL Injection Affected: Ghost 3.24.0 – 6.19.0 Fixed in: Ghost 6.19.1 Auth required: None — Content API key is public Impact: Unauthenticated read of the entire database credentials, API keys Vulnerability slug-filter-order.js interpolates user-supplied...

CVE-2026-85688

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

CVE-2026-85688

TEN Framework 0.11.71 is vulnerable to unauthenticated arbitrary file read and write via the TMAN Designer file-content API endpoints (/api/designer/v1/file-content). Attackers can send POST and PUT requests to read arbitrary files or write malicious content to system paths, enabling code executi...

Exploit for SQL Injection in Ghost

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content AP...

CVE-2026-67617

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

Strapi Content API Sanitization Bypass Detection Module Scanner

This Python script assesses exposure to CVE-2026-27886 in Strapi Content API endpoints by performing differential filter validation against where parameters. Detection compares baseline query behavior against controlledfilter predicates to determine whether unsanitized conditions reach backend...

BIT-GHOST-2026-53949 Ghost Content API filter bypass reveals private fields

Ghost is a Node.js content management system. From 5.46.1 until 6.21.2, the validation applied to filters on the public API endpoints could be partially bypassed, making it possible to reveal private fields via a brute force attack. If SQLite was used as the database password hashes were fully...

Exploit for SQL Injection in Ghost

CVE-2026-26980 — Ghost CMS Content API Blind SQL Injection...

CVE-2026-53949

Summary (CVE-2026-53949) Ghost CMS (Node.js). Affected versions: 5.46.1–6.21.2. Description: validation on filters for public API endpoints could be partially bypassed, enabling disclosure of private fields via brute-force. Impact depends on database: with SQLite, password hashes were fully acces...

CVE-2026-27886

Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the where query parameter on any publicly-accessibl...

ANT-2026-69D8H6RP · TryGhost/Ghost · SQL Injection

sql-injection critical CVE-2026-26980 GHSA-w52v-v783-gw97 Severity Claude critical · Security research firm - · Maintainer critical REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-69D8H6RP: Critical Vulnerability CVSS 9.1 : SQLi from unauthenticated user; arbitrary DB...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Strapi

CVE-2026-27886 Vulnerability Assessment Tool Safely detect wh...

GHSA-5H62-F8FG-4W7Q Duplicate Advisory: phpMyFAQ: Missing Authorization on Tag Deletion Allows Any Authenticated User to Delete Tags

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7cx3-2qx2-3g6w. This link is maintained to preserve external references. Original Description phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/tagId...