Pagekit CMS CVE-2026-88756

No special conditions - remote unauthenticated exploitation against a default Pagekit CMS <= 1.0.18 by POSTing an SQL injection payload inside the credentials array to the public /user/authenticate login endpoint. The only real limiter is product exposure: the target must be a reachable Pagekit instance at or below the vulnerable version. No authentication, no user interaction, and no non-default configuration are required, so any internet-facing vulnerable install is directly exploitable.

Signals are moderate but internally inconsistent. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N = 5.3) describes unauthenticated, network-reachable, low-complexity SQL injection but caps impact at C:L only - which understates a login-endpoint SQLi that in practice can dump credential hashes or achieve authentication bypass (arguably C:H and/or I:H). EPSS is low at 0.15% (5th percentile) and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation. However, a public proof-of-concept repository is referenced (github.com/Miniko233/Pagekit-CMS-vulnerable-to-SQL-Injection...), so publicly available exploit code exists - raising practical risk above what EPSS alone implies. Net: a genuinely exploitable unauthenticated flaw with a working PoC, but on a low-footprint, effectively unmaintained CMS, so it is a moderate priority for the small population that still runs Pagekit rather than a broad emergency. Note the CPE is 'n/a' and EUVD versions are 'n/a', so affected-version data beyond the description's '<= 1.0.18' is unconfirmed - verify against the vendor repo.

An unauthenticated attacker sends a crafted POST /user/authenticate request where the credentials array carries an SQL injection payload, which is concatenated into the authentication query. Because a public PoC exists, an attacker can adapt it to extract user records/password hashes or bypass authentication. No user interaction or prior access is required.