Craft Cms 4.0.0 Before 4.18.9 Blind Sql Injection Via Getnext Getprev Criteria

Back www.vulncheck.com

Craft Cms 4.0.0 Before 4.18.9 Blind Sql Injection Via Getnext Getprev Criteria

www.vulncheck.com • November 6, 2026

Share: View original

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

GitHub Security Advisory (GHSA-f6gf-r952-rxg6)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OpenEMR and Craft CMS Vulnerabilities Expose SQL Injection Risks Two SQL injection vulnerabilities have been identified in OpenEMR versions before 8.4.0 and Craft CMS versions before 4.18.9. Both vulnerabilities, classified under CWE-89, allow attackers to manipulate SQL queries through specific API endpoints. OpenEMR's vulnerability is associated with the onsitedocument query API, while Craft CMS's issue involves the getnext and getprev criteria. These vulnerabilities could potentially lead to unauthorized data access or manipulation. Patches have been released for both systems, and users are urged to update immediately to mitigate risks. The vulnerabilities have not been reported as in the wild as of the latest updates. 45

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-89 - SQL Injection

Vulnerabilities (1)

GHSA-f6gf-r952-rxg6