CVE-2026-88756
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Pagekit CMS up to version 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).
Risk Assessment
An attacker can inject malicious SQL queries without authentication, potentially leading to data leakage, modification, or deletion. The vulnerability is easily exploitable remotely.
Recommendation
Update Pagekit CMS to a version newer than 1.0.18 or apply the vendor patch. Until then, consider restricting access to the /user/authenticate endpoint.
Other vulnerabilities in Pagekit CMS
See all- CVE-2017-5594High
An issue was discovered in Pagekit CMS before 1.0.11 that allows a remote attacker to reset a registered user's password when the debug toolbar is enabled. The password can be successfully recovered using this exploit.
- CVE-2025-67165Critical
Pagekit CMS version 1.0.18 contains an Insecure Direct Object Reference (IDOR) vulnerability that allows attackers to escalate privileges.
- CVE-2025-67164Critical
Pagekit CMS version 1.0.18 contains an authenticated arbitrary file upload vulnerability in the /storage/poc.php component, allowing attackers to execute arbitrary code by uploading a crafted PHP file.
- CVE-2026-57518High
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to assign arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.
Original NVD description (English source)
Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS