CVE-2026-115934

An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search, allowing stacked query execution and enabling escalation to an administrator. Note that this only affects MySQL/MariaDB. Impact SQL injection — The attribute parameter is concatenat...

CVE-2026-115934

An unauthenticated SQL injection exists in CraftCMS CMS versions prior to 4.18.9 and 5.11.2 when using the craft.search front-end search endpoint. The vulnerability occurs because the attribute parameter is concatenated into the SQL query without sanitization. When running on MySQL or MariaDB wit...