CVE-2026-78416None▾ SunlitCraft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.0%
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-265m-7826-wjqmHighCraft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass
CVE-2026-114573NoneMonster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253
CVE-2026-118538Medium· 5.5a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
CVE-2026-58255High· 8.8Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401
CVE-2025-24370CriticalDjango-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
CVE-2025-58367CriticalDeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more