⤷ Title: CVE-2026-25544: Critical Payload CMS SQLi (CVSS 9.8) Exposes Admin Tokens
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 10 Feb 2026 00:07:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #blind sqli #CVE_2026_25544 #database security #Drizzle ORM #Headless CMS #Next.js #Patch Alert #Payload CMS #sql injection #web development
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 10 Feb 2026 00:07:05 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #blind sqli #CVE_2026_25544 #database security #Drizzle ORM #Headless CMS #Next.js #Patch Alert #Payload CMS #sql injection #web development
Daily CyberSecurity
CVE-2026-25544: Critical Payload CMS SQLi (CVSS 9.8) Exposes Admin Tokens
Critical Payload CMS flaw CVE-2026-25544 (CVSS 9.8) allows SQL injection via JSON fields. Unauthenticated attackers can steal admin tokens. Update to v3.73.0.