Payloadcms

Payload

13 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2026-34750

  • EPSS 0.06%
  • Veröffentlicht 01.04.2026 19:51:59
  • Zuletzt bearbeitet 13.04.2026 19:15:38

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GC...

5.4

CVE-2026-34749

  • EPSS 0.02%
  • Veröffentlicht 01.04.2026 19:49:35
  • Zuletzt bearbeitet 13.04.2026 19:13:43

Payload is a free and open source headless content management system. Prior to version 3.79.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the authentication flow. Under certain conditions, the configured CSRF protection could be bypa...

8.7

CVE-2026-34748

  • EPSS 0.03%
  • Veröffentlicht 01.04.2026 19:48:10
  • Zuletzt bearbeitet 13.04.2026 19:13:21

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/next, a stored Cross-Site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection c...

8.2

CVE-2026-34747

  • EPSS 0.05%
  • Veröffentlicht 01.04.2026 19:45:24
  • Zuletzt bearbeitet 13.04.2026 18:53:11

Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying ...

7.7

CVE-2026-34746

  • EPSS 0.03%
  • Veröffentlicht 01.04.2026 19:43:16
  • Zuletzt bearbeitet 13.04.2026 18:52:39

Payload is a free and open source headless content management system. Prior to version 3.79.1, an authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the upload functionality. Authenticated users with create or update access to a...

9.1

CVE-2026-34751

  • EPSS 0.05%
  • Veröffentlicht 01.04.2026 17:42:45
  • Zuletzt bearbeitet 15.04.2026 14:36:31

Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a ...

4.8

CVE-2026-27567

  • EPSS 0.01%
  • Veröffentlicht 24.02.2026 14:22:37
  • Zuletzt bearbeitet 26.02.2026 19:59:33

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insuffic...

9.8

CVE-2026-25544

  • EPSS 0.04%
  • Veröffentlicht 06.02.2026 21:07:01
  • Zuletzt bearbeitet 20.02.2026 20:14:42

Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fields, user input was directly embedded into SQL without escaping, enabling blind SQL injection attacks. An unauthenticated attacke...

5.4

CVE-2026-25574

  • EPSS 0.01%
  • Veröffentlicht 06.02.2026 21:04:48
  • Zuletzt bearbeitet 20.02.2026 20:14:13

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direct Object Reference (IDOR) vulnerability exists in the payload-preferences internal collection. In multi-auth collection environmen...

5.3

CVE-2025-4644

  • EPSS 0.07%
  • Veröffentlicht 29.08.2025 10:01:13
  • Zuletzt bearbeitet 15.04.2026 00:35:42

A Session Fixation vulnerability existed in Payload's SQLite adapter due to identifier reuse during account creation. A malicious attacker could create a new account, save its JSON Web Token (JWT), and then delete the account, which did not invalidat...