CVE-2026-105652

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652

The Ghost Node.js content management system is vulnerable to a Password Hash Ordering Disclosure in its Admin API. In versions 0.7.2 through 6.64.0 , any user with staff-level privileges could determine the relative ordering of other staff users' hashed passwords. While this vulnerability does no...

CVE-2026-105652 Ghost: Password Hash Ordering Disclosure in Ghost Admin API

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

CVE-2026-105652: Observable Discrepancy

Ghost is a Node.js content management system. From 0.7.2 until 6.64.0, any staff-level user was able to determine the relative ordering of other staff users' hashed passwords. This does not directly disclose password hashes, and does not provide a practical path to recovering a password. This iss...

PT-2026-106186

Name of the Vulnerable Software and Affected Versions Ghost versions 0.7.2 through 6.63.x Description Staff-level users can determine the relative ordering of hashed passwords belonging to other staff users. This issue does not directly disclose the password hashes or provide a practical method f...

CVE-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

CVE-2026-104415 Ghost 0.7.2 before 6.64.0 Password Hash Ordering Disclosure via Admin API

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

CVE-2026-104415

The Ghost platform (versions 0.7.2 before 6.64.0 ) contains an information disclosure vulnerability within the Admin API . Authenticated users with staff-level privileges can query the Admin API to determine the relative ordering of password hashes belonging to other staff users. While this allow...

CVE-2026-104415: Observable Discrepancy

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

CVE-2026-103275

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

EUVD-2026-90668

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

CVE-2026-103275 Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

PT-2026-103807

Name of the Vulnerable Software and Affected Versions Ghost versions 5.42.2 through 6.57.0 Description An information disclosure issue exists in the Admin API bulk post and page edit and delete endpoints. These endpoints allow filters on restricted fields, such as authors.password, due to an...

CVE-2026-103275: Observable Discrepancy

Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, which accept filters on restricted fields such as authors.password, because of an incomplete fix for CVE-2026-70590. Staff-level attackers can infer other sta...

EUVD-2026-87890

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-86839: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify a...

CVE-2026-12905

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

CVE-2026-13613: Improper Neutralization of Special Elements used in an SQL Command

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection...

SQL Injection

Overview civicrm/civicrm-core is an open source constituent relationship management for non-profits, NGOs and advocacy organizations. Affected versions of this package are vulnerable to SQL Injection via the contact search RLIKE clause. An attacker can access and extract the entire database by...