PT-2026-84744

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via array intersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79990: Authorization Bypass Through User-Controlled Key

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79991: Improper Neutralization of Special Elements used in an SQL Command

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

Joomla Component EasyBook 1.1 (gbid) SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================================== Joomla Component EasyBook 1.1 gbid SQL Injection Exploit ========================================================== !/usr/bin/perl use IO::Socket; use strict; INFO Example: Host:...