CVE-2026-88756 Details
Description
Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint (POST /user/authenticate).
A SQL injection vulnerability has been identified in Pagekit CMS versions through 1.0.18. The issue allows an unauthenticated attacker to exploit the public login endpoint by injecting malicious array keys into the credentials array. These keys are then interpolated into the SQL WHERE clause without proper validation, creating a direct pathway for SQL injection.
No official patch is available for this vulnerability, as the Pagekit CMS project is unmaintained. Users are advised to migrate away from Pagekit CMS and ensure that the application debug mode is disabled in production.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Miniko233/Pagekit-CMS-vulnerable-to-SQL-Injection-in-user-authentication | [email protected] | ExploitTechnical Analysis |
| https://github.com/pagekit/pagekit | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Pagekit | <= 1.0.18 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |