CVE-2026-123489

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

November 9, 2026

Last Seen

November 9, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Critical SQL Injection Vulnerability in Craft CMS Enables Admin Takeover77.3

Craft CMS has a critical vulnerability, CVE-2026-123488, allowing unauthenticated SQL injection that grants attackers read and write access to the database. This flaw affects Craft versions 4.18.9 and 5.11.2, enabling unauthorized changes to administrator status and password hashes. The vulnerabilit...