CVE-2026-63316 | Payload up to 3.89.x Query Parameter in/not_in sql injection

October 13, 2026 Yanac

A vulnerability was found in Payload up to 3.89.x. It has been declared as critical. This issue affects some unknown processing of the component Query Parameter Handler. Such manipulation of the argument in/not_in leads to sql injection.

This vulnerability is uniquely identified as CVE-2026-63316. The attack can be launched remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More