Pagekit CMS versions 1.0.18 and earlier contain an SQL injection vulnerability in the public login endpoint that accepts user credentials via a POST request to /user/authenticate. The server does not properly sanitize the credentials array, allowing an unauthenticated attacker to inject arbitrary SQL statements directly into the query. This flaw permits the attacker to read, modify, or delete data from the database, thereby compromising both the confidentiality and integrity of stored information. The weakness is a classical SQL injection (CWE‑94) with the potential to elevate to broader compromise if the database contains sensitive data.

Affected by vendor Pagekit, product Pagekit CMS, versions 1.0.18 and earlier. No other specific vendor or product information is available from the CVE entry.

The exploit is possible remotely over HTTP without requiring authentication, leveraging the public login API. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, a precise quantitative risk remains unclear. However, the lack of authentication controls and input validation creates a high likelihood of exploitation by automated web scanners or opportunistic adversaries. The CVSS score is not provided, but the nature of the flaw suggests significant risk to database assets.