NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 5h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 5h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 6h Vulnerabilitas in software Sparx Systems Enterprise Architect · 6h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 6h Vulnerabilitates in Slican telephonis · 7h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 10h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 10h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 11h EU Mercatores Gravem Pretium Solvunt Pro Firmware Frigoris Non Purgato · 11h NGINX Corrigit 5 Vitia, Inclusa Possibili RCE et Bug TLS Qui Potest Saltare Client-Cert Checks · 5h Next.js Emittit Emendationem Extra Ordinem pro Duobus Criticis RCE Defectibus in Caching et SVG Processu · 5h Drupal Patches Criticum Core RCE Vitium Sine Login Via Contributis Modulis · 6h Vulnerabilitas in software Sparx Systems Enterprise Architect · 6h Curl verhelpt 'high' RCE-kwetsbaarheid gevonden door Anthropic · 6h Vulnerabilitates in Slican telephonis · 7h Palo Alto Networks monet ad abusum vulnerabilitatis in ignibus securitatis · 10h Cisco nuntiat activum abusus criticae vulnerabilitatis in Secure Email Gateway · 10h Langflow's Critica Authenticated RCE Vulnerabilitas Targetata in 1,423 Honeypot Exploit Conatibus · 11h EU Mercatores Gravem Pretium Solvunt Pro Firmware Frigoris Non Purgato · 11h

ACyber Sentinel Turma Aestimationis Securitatis

← Redire

⚡ Renuntiatio

Vulnerabilitas in software Payload CMS

📰 cert.pl 🕐 Oct 13, 2026 10:55 ⏱ 1 minuta lectio ⚠️ 1 CVE

Vulnerabilitas in software Payload CMS

CVE ID

CVE-2026-63316

Data publicationis

13 Octobris 2026

Venditor

Payload

Productum

Payload CMS

Versiones vulnerabiles

Omnes ante 3.90.0 A 4.0.0-canary.0 ad 4.0.0-canary.34

Typus vulnerabilitatis (CWE)

Impropria Neutralizatio Elementorum Specialium in SQL Imperio usorum ('SQL Injectio') (CWE-89)

Fons relationis

Relatio ad CERT Polska

Descriptio

CERT Polska relationem de vulnerabilitate in software Payload CMS accepit et in coordinatione eius revelationis participavit.

Vulnerabilitas CVE-2026-63316: Vulnerabilitas SQL Injection in Payload CMS identificata est. Impropria neutralizatio inputi a usuario in parametris quaestionum in et non_in permittit impugnatori authentico SQL Injection impugnationes perficere.

Haec quaestio in versione 3.90.0 et 4.0.0-canary.34 soluta est.

Credita

Gratias agimus 0xMesbaha pro responsabili relatione vulnerabilitatis.

Plura de processu revelationis vulnerabilitatis coordinatae apud CERT Polska in https://cert.pl/en/cvd/ inveniuntur.

Vulnerabilitates Relatae

CVE-2026-63316 CVSS 8.7 HIGH Received

CVE-2026-63316 - SQL Injection in Payload CMS

A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34.