Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-elements endpoint is vulnerable to SQL Injection via the criteria[orderBy] parameter (JSON body). The application fails to sanitize this input before using it in the database query. An attacker with Control Panel access can inject arbitrary SQL into the ORDER BY clause by omitting viewState[order] (or setting both to the same payload). This issue is patched in versions 4.16.18 and 5.8.22.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
CVE-2026-25495 Craft is a platform for creating digital experiences. In Craft versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, the element-indexes/get-elements endpo… https://www.cve.org/CVERecord?id=CVE-2026-25495
Post summary
Disclosed CVE‑2026‑25495 impacts Craft platform versions 4.x and 5.x, affecting the element‑indexes/get‑elements endpoint.
CVE-2026-25495: Craft CMS: The Art of SQL Injection via Mass Assignment A high-severity SQL injection vulnerability in Craft CMS allows authenticated Control Panel users to execute arbitrary SQL commands. The flaw stems from a mass assignment vulnerab... https://cvereports.com/reports/CVE-2026-25495
Post summary
The text discloses a high‑severity SQL injection vulnerability in Craft CMS that permits authenticated Control Panel users to execute arbitrary SQL commands through a mass‑assignment flaw, but it provides no PoC, exploit code, or patch information.
CVE-2026-25495 SQL Injection in Craft CMS Control Panel via Unsanitized Order By Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25495
Post summary
The text announces a new SQL injection vulnerability in Craft CMS's Control Panel, triggered by an unsanitized order‑by parameter, but does not provide PoC, exploit code, or active exploitation evidence.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftcms | craft_cms | - | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |