Payload CMS SQL Injection

hussienmisbah11@gmail.com (0xMesbaha) — Tue, 29 Sep 2026 12:49:18 +0200

Payload CMS is an open-source,full-stack framework/CMS built natively on Next.js. It gives you a backend, database layer, Admin Panel, authentication, APIs, access control, uploads, and content management without having to build those pieces yourself. they always highlight “Define your schema in code and get a full TypeScript backend and admin panel. Instantly.” in their Docs to ensure easy deployment, they handle everyting for you from admin panel , apis , database and more. PayloadCMS is one of the most fast growing platforms as they have 589.1k downloads weekly.

I have been playing with Ai Tools/Models/agents harness for a while trying to get the most benefits out of it in some areas specially vulnerability research and CVE Discovery. Don’t worry, this blog post isn’t just another piece of AI slop content :“D

This research results goes back to June 2026 but they just fixed it so i can blog about it, in this post we will go through what i did to discover such bug and the reason of this post is not just showing some basic SQL Injection example or showing how great AI is at discovering vulnerabilites but the technique of exploitation is really cool and even frontier models at that time wasn’t able to spot it initialy without guidance and hinting which makes it even cooler. also a side note the Maintainers said before “We regularly red-team our own codebase, including review of pull requests as they’re opened and merged, so issues are caught before they ship rather than after.”

VR on 0xMesbaha

Payload CMS SQL Injection