CVE-2026-34747
High · 8.5CVSS
8.5
EPSS
0.4%
Published
Apr 1, 2026
CISA due date
—
The record
Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections. This issue has been patched in version 3.79.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | payload | 0 | 3.79.1 |
Related vulnerabilities
- GHSA-7xxh-373w-35vg Payload has an SQL Injection via Query Handling Same vulnerability
- GHSA-p6mr-xf3r-ghq4 Payload has a CSRF Protection Bypass in Authentication Flow Also affects payload
- GHSA-6r7f-q7f5-wpx8 Payload has Authenticated SSRF via Upload Functionality Also affects payload
- CVE-2026-34749 Payload is a free and open source headless content management system. Also affects payload
- CVE-2026-34746 Payload is a free and open source headless content management system. Also affects payload
- CVE-2026-34751 Payload is a free and open source headless content management system. Also affects payload
- GHSA-hp5w-3hxx-vmwf Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery Also affects payload
- GHSA-hhfx-5x8j-f5f6 Payload: Server-Side Request Forgery (SSRF) in External File URL Uploads Also affects payload