CVE-2026-88756

Pagekit CMS versions 1.0.18 and below are vulnerable to SQL injection via the credentials array submitted to the public login endpoint (POST /user/authenticate). Because the endpoint is publicly accessible, an unauthenticated attacker can exploit this flaw without valid credentials. The vulnerabi...