Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Payload — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in Payload, with AI-generated Chinese analysis, references, and POCs.

Vendor: payloadcms

CVE IDTitleCVSSSeverityPublished
CVE-2026-34750 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints CWE-22 6.5 Medium2026-04-01
CVE-2026-34749 Payload has a CSRF Protection Bypass in Authentication Flow CWE-352 5.4 Medium2026-04-01
CVE-2026-34748 @payloadcms/next has Stored XSS in Admin Panel CWE-79 8.7 High2026-04-01
CVE-2026-34747 Payload has an SQL Injection via Query Handling CWE-89 8.5 High2026-04-01
CVE-2026-34746 Payload has Authenticated SSRF via Upload Functionality CWE-918 7.7 High2026-04-01
CVE-2026-34751 Payload has Unvalidated Input in Password Recovery Endpoints CWE-472 9.1 Critical2026-04-01
CVE-2026-27567 Payload has Server-Side Request Forgery (SSRF) in External File URL Uploads CWE-918 6.5 Medium2026-02-24
CVE-2026-25544 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CWE-89 9.8 Critical2026-02-06
CVE-2026-25574 Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments) CWE-639 5.4 Medium2026-02-06
CVE-2025-4644 User Session Fixation after Account Removal in PayloadCMS CWE-384 8.8 -2025-08-29
CVE-2025-4643 Lack of JWT Expiration after Log Out in PayloadCMS CWE-613 9.1 -2025-08-29
CVE-2023-30843 Payload's hidden fields can be leaked on readable collections CWE-200 7.4 High2023-04-26

All 12 known CVE vulnerabilities affecting Payload with full Chinese analysis, references, and POCs where available.