SQL Injection Vulnerability in Movable Type by Six Apart Ltd.
CVE-2026-33088
6.9MEDIUM
What is CVE-2026-33088?
Movable Type, developed by Six Apart Ltd., is susceptible to an SQL Injection vulnerability that could allow an attacker to manipulate SQL queries by injecting malicious code. This weakness may lead to unauthorized data access or data manipulation, posing significant risks to web application security. Users and administrators of affected Movable Type versions should prioritize patching to safeguard their systems against exploitation.
Affected Version(s)
Movable Type 9.1.0 and earlier
Movable Type 9.0.6 and earlier
Movable Type 8.8.2 and earlier
References
CVSS V4
Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
CVSS V3.0
Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved