CVE-2026-88756: SQL Injection
Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker who can reach the public login endpoint at POST /user/authenticate may be able to exploit it. No existing account or prior authentication is required.
Which deployments are affected?
Pagekit CMS versions 1.0.18 and earlier are affected according to the available information. The vulnerable input is the credentials array accepted by the public login endpoint.
What should be prioritized if a patch is not immediately available?
Restrict access to the public login endpoint where operationally possible, such as limiting it to trusted networks or placing it behind an access-control layer. Because exploitation is unauthenticated, internet-exposed instances should be treated as higher priority.