CVE-2026-63316 — SQL Injection in Payload CMS
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authentica…
Published: 2026-10-13 · CVSS: 8.7 · CVSS 4.0
A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 3.90.0 and 4.0.0-canary.34.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7