Loading story…
Payload disclosed two high-severity vulnerabilities affecting versions prior to 3.79.1 of payload and @payloadcms/graphql, including an SQL injection issue tracked as CVE-2026-34747 and an unvalidated input flaw in password recovery endpoints tracked as CVE-2026-34751. The SQL injection bug stems from improper validation of certain request inputs and could let an attacker influence query execution to expose or modify collection data. The password recovery flaw could allow an unauthenticated attacker to perform actions on behalf of a user who has initiated a password reset.
The vulnerabilities were patched in Payload 3.79.1, with advisories mapping the issues to CWE-89 for SQL injection and CWE-640 and CWE-472 for the password recovery weakness. The SQL injection issue carries a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, while the password recovery flaw is rated AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating significant confidentiality and integrity risk for exposed deployments that have not yet upgraded.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Public advisories disclosed two high-severity Payload vulnerabilities on April 1, 2026. CVE-2026-34747 could let an attacker influence SQL query execution to expose or modify collection data, while CVE-2026-34751 could let an unauthenticated attacker act on behalf of a user during the password reset flow.
Payload released version 3.79.1 to patch two vulnerabilities affecting earlier versions: an SQL injection issue in query handling (CVE-2026-34747) and an unvalidated input flaw in password recovery endpoints (CVE-2026-34751). The fixes apply to affected Payload components including payload and @payloadcms/graphql.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two content management systems were identified with **unauthenticated SQL injection** vulnerabilities that allow remote attackers to tamper with backend database queries and extract sensitive information. `CVE-2019-25697` affects **CMSsite 1.0**, where the `cat_id` parameter in `category.php` can be abused through crafted `GET` requests, potentially exposing usernames, credentials, and other database contents. A separate flaw, `CVE-2018-25300`, affects **XATABoost CMS 1.0.0** through a **union-based SQL injection** in the `id` parameter of `news.php`, also reachable remotely without authentication via crafted `GET` requests. Both records were published with **CWE-89** classification, CVSS v3.1 and v4.0 scoring data, and references to public advisories and exploit resources, underscoring the risk of database compromise in internet-exposed deployments.
Jun 29, 2026
Connect-CMS disclosed two high-severity vulnerabilities affecting **all 1.x and 2.x releases through `1.41.0` and `2.41.0`**. The first, **`CVE-2026-32300`**, is an improper authorization issue in the **My Page profile update** feature that can let an authenticated attacker modify arbitrary user information. The flaw is mapped to **`CWE-285`** and **`CWE-639`** and carries a **CVSS 3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N`, indicating high confidentiality and integrity impact without requiring user interaction. The second issue, **`CVE-2026-32278`**, is a **stored cross-site scripting (XSS)** vulnerability in the **Form Plugin** file field. It is mapped in the advisory to **`CWE-434`** and has a **CVSS 3.1** vector of `AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L`, reflecting the potential for attacker-supplied content to execute in users' browsers after interaction. Both vulnerabilities were fixed in **`1.41.1`** and **`2.41.1`**, with advisories pointing to the relevant patch commit, release tags, and GitHub Security Advisory entries.
Jun 29, 2026
Splunk issued urgent fixes for **CVE-2026-20253**, a critical `CVSS 9.8` vulnerability in **Splunk Enterprise** that allows unauthenticated arbitrary file creation and truncation through a PostgreSQL sidecar service endpoint missing authentication controls. The flaw affects supported Splunk Enterprise releases prior to **10.4.0**, **10.2.4**, **10.0.7**, **9.4.12**, and **9.3.13** depending on branch, and Splunk said **Splunk Cloud is not affected** because it does not use Postgres sidecars. Splunk and national cyber authorities urged administrators to apply updates immediately, noting that no vendor detections or workarounds were initially available for the core issue. Public technical analysis from watchTowr Labs showed the bug can be reached through Splunk Web on port `8000`, which proxies requests to localhost-only PostgreSQL recovery endpoints, enabling attackers to abuse `/v1/postgres/recovery/backup` and `/restore` for filesystem access. Researchers demonstrated a full pre-auth exploitation chain that used path traversal, PostgreSQL connection-string injection, local `.pgpass` credentials, and PostgreSQL large-object export to gain arbitrary file write as the `splunk` user, then overwrite a Splunk Python script to achieve remote code execution. Splunk also disclosed additional Enterprise flaws including **CVE-2026-20251** (`CVSS 8.8`) in the Splunk Secure Gateway app due to unsafe `jsonpickle` deserialization, plus stored XSS and SSRF issues, prompting guidance to patch quickly, restrict dashboard creation and web exposure, and disable or remove vulnerable components where immediate upgrades are not possible.
Jul 23, 2026