{"id":"CVE-2026-63316","published":"2026-10-13T12:17:14.473","lastModified":"2026-10-16T20:04:29.760","description":"A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into \"in\" and \"not_in\" query paramethers allows an authenticated attacker to perform SQL Injection attacks.\n\nThis issue was fixed in version 3.90.0 and 4.0.0-canary.34.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://cert.pl/posts/2026/10/CVE-2026-63316","tags":[]},{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp","tags":[]}],"exploitRefs":[{"url":"https://github.com/payloadcms/payload/security/advisories/GHSA-pj7x-6wpf-pgvp","tags":[]}],"hasPoc":true,"ai":null}