Loading story…
The Grav CMS grav-plugin-database component received security fixes for a SQL injection flaw in PDO::tableExists(), where a table name was interpolated directly into a raw SQL query without sanitization or quoting. The issue, tracked as CVE-2026-58492 and GHSA-8jxg-4pw9-xcwf, could let attacker-controlled input supplied through plugin or developer code execute arbitrary SQL against the configured database, with potential confidentiality and integrity impact. The vulnerability affects versions prior to 1.2.0, and the CVE record notes proof-of-concept exploitation status with non-automatable exploitation and partial technical impact.
A related code update in the Grav Database plugin replaced the unsafe table lookup with a parameterized, driver-aware catalog query and also addressed a second hardening issue, GHSA-jm58-p4pv-qcwc, involving DSN attribute injection. The patch validates connection-setting fields, casts ports to integers, and removes PostgreSQL credentials from the DSN, while also adding an onDatabaseDrivers event to support third-party database drivers.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-10, CVE-2026-58492 was created for a SQL injection vulnerability in grav-plugin-database's `PDO::tableExists()` method. The record states the flaw affects versions prior to 1.2.0 and notes it was later updated the same day with SSVC metadata including proof-of-concept exploitation status.
On 2026-06-18, getgrav released grav-plugin-database version 1.1.3 with security fixes. The update remediated a potential SQL injection in `tableExists()` by replacing raw table-name interpolation with a parameterized, driver-aware catalog lookup, and also included DSN hardening changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A mass disclosure detailed **11 vulnerabilities** in **Grav CMS** and the **`getgrav/grav-plugin-api`** package, with the most severe issues affecting the API plugin before **`1.0.13`** and Grav CMS before **`2.0.13`**. Multiple API endpoints failed to enforce API key scope caps or relied on bare `isSuperAdmin()` checks instead of scope-aware permission validation, allowing least-privilege or narrowly scoped keys to perform privileged actions. Reported impacts include creating unrestricted API keys (`CVE-2026-72826`), promoting users or invited accounts to super-admin (`CVE-2026-72828`, `CVE-2026-72829`, `CVE-2026-72833`), and disabling 2FA for non-super accounts without a TOTP code via `POST /api/v1/users/{user}/2fa/disable` (`CVE-2026-72822`). The disclosure also included several paths to **remote code execution**. In the API plugin, `CVE-2026-72830` allows attackers with `api.config.write` access to alter scheduler settings and inject commands through `scheduler.custom_jobs`, while `CVE-2026-72824` can enable Twig processing during page saves and lead to server-side template injection under certain settings. In core Grav CMS, `CVE-2026-72819` allows authenticated users to upload a malicious ZIP through Flex Objects and write PHP files to the web root, and `CVE-2026-72827` enables Twig injection through email-action parameters that can execute OS commands when forms are submitted. Advisories recommend upgrading to **Grav `2.0.13`** and **API plugin `1.0.13`**, rotating API keys, and auditing super-admin accounts, invitations, scheduler jobs, and 2FA settings; no active exploitation was reported at publication time.
Aug 19, 2026
Drupal released security updates for **CVE-2026-9082**, a highly critical SQL injection flaw in Drupal core that affects websites using **PostgreSQL** databases. The vulnerability stems from improper neutralization of special characters in user input within Drupal's database API, allowing an unauthenticated remote attacker to send crafted requests that can trigger SQL injection. Successful exploitation could lead to **information disclosure**, **privilege escalation**, and in some environments potentially **remote code execution**. Drupal and downstream defenders urged administrators to upgrade to fixed versions **10.4.10**, **10.5.10**, **10.6.9**, **11.1.10**, **11.2.12**, or **11.3.10**, while manual patches were also issued for unsupported **8.9** and **9.5** branches; the flaw's severity was raised to **CVSS 9.8** after initial scoring understated the risk.
Jul 24, 2026
CakePHP disclosed and patched **CVE-2026-77635**, a SQL injection flaw in `FunctionsBuilder::jsonValue()` when used with the PostgreSQL driver. The weakness allowed query manipulation if attacker-controlled input was passed to the `jsonPath` parameter, affecting CakePHP and `cakephp/database` versions `>= 5.1.0, < 5.1.10`, `>= 5.2.0, < 5.2.15`, and `>= 5.3.0, < 5.3.7`. The issue is tracked as **CWE-89** and carries a CVSS v4 assessment indicating network exploitability, low attack complexity, no privileges required, and high confidentiality and integrity impact. Maintainers released fixes across supported branches in commits for the `5.2.x`, `5.3.x`, and `5.x` lines, changing how PostgreSQL-specific `jsonValue` expressions are transformed. Regression tests added with the patches show legitimate JSON path extraction still works, while malicious path payloads now fail with a PostgreSQL syntax error surfaced as a `QueryException` instead of enabling successful query manipulation. The fix was credited to reporter **Himanshu Anand**, and patched releases include `5.1.10`, `5.2.15`, and `5.3.7`.
Aug 25, 2026