CVE-2026-34747 - Vulnerability Analysis

Overview

Payload < 3.79.1 contains a SQL injection caused by improper validation of certain request inputs, letting attackers expose or modify data in collections, exploit requires crafted requests.

Severity & Score

Impact

Attackers can expose or modify data in collections, potentially compromising data integrity and confidentiality.

Mitigation

Update to version 3.79.1 or later.

References

• https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg
• https://github.com/payloadcms/payload/releases/tag/v3.79.1

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 2, 2026

🟠 CVE-2026-34747 - High (8.5) Payload is a free and open source headless content management system. Prior to version 3.79.1, certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifyi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34747/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner