{"id":"CVE-2026-103668","published":"2026-10-07T11:17:09.357","lastModified":"2026-10-07T18:17:14.823","description":"An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://jvn.jp/en/jp/JVN91153973/","tags":[]},{"url":"https://movabletype.org/news/2026/10/mt-930-released.html","tags":[]},{"url":"https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"An SQL Injection vulnerability in Movable Type's Site Search function allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to data theft or manipulation.","exploitability":"Exploitation requires access to the Site Search function, which may be relatively easy if the feature is enabled and not properly restricted.","blast_radius":"If exploited, the vulnerability could lead to unauthorized data access or manipulation, impacting the integrity and confidentiality of the application's database.","remediation":"Disable the Site Search feature or apply the vendor's patch, specifically 'Upgrade to version 6.3.10 or later'.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","unauth","data-exposure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:44:43.273Z"}}