Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-33088 Details

Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:7.3 HIGHVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://jvn.jp/en/jp/JVN66473735/	[email protected]	Third Party Advisory
https://movabletype.org/news/2026/04/mt-907-released.html	[email protected]	Vendor Advisory
https://www.sixapart.jp/movabletype/news/2026/04/08-1100.html	[email protected]	Vendor Advisory

CWE-ID	CWE Name	Source
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	[email protected]

Product	Versions
sixapart movable type	>= 8.0.2, < 8.0.10 >= 8.8.0, < 8.8.3 >= 9.0.1, < 9.0.7 9.1.0 <= 2.14
CPE cpe:2.3:a:sixapart:movable_type:::::advanced:::* cpe:2.3:a:sixapart:movable_type:9.1.0::::advanced::: cpe:2.3:a:sixapart:movable_type:::::premium_advanced:::* cpe:2.3:a:sixapart:movable_type:9.0.5::::premium_advanced::: cpe:2.3:a:sixapart:movable_type:9.0.6::::premium_advanced::: cpe:2.3:a:sixapart:movable_type:9.1.0::::premium_advanced::: Remediation No remediation found in references.

Product

Versions

sixapart movable type

>= 8.0.2, < 8.0.10

>= 8.8.0, < 8.8.3

>= 9.0.1, < 9.0.7

9.1.0

<= 2.14

5 change records found show changes

QUICK INFO