Pagekit CMS versions 1.0.18 and earlier allow an unauthenticated attacker to inject SQL through the credentials array submitted to the public login endpoint (POST /user/authenticate). The server does not properly escape or validate this input, enabling the attacker to append arbitrary SQL statements to the underlying query. This flaw is a classic SQL injection (CWE‑89) that could enable the attacker to read, modify, or delete database contents, thereby compromising confidentiality, integrity, and potentially availability of the site’s data.

Only the Pagekit CMS product is impacted, with versions 1.0.18 and earlier susceptible. No other vendor or product information is indicated in the CVE entry.

The vulnerability can be exploited remotely over standard HTTP traffic without authentication, solely by submitting crafted data to /user/authenticate. The CVSS score of 5.3 indicates a moderate severity assessment, while an EPSS score of less than 1% indicates a low probability of current exploitation. The flaw is not listed in the CISA KEV catalog, meaning no publicly known active exploitation is documented. Nonetheless, an attacker could automate exploitation attempts against exposed Pagekit instances in order to compromise the underlying database.