CVE-2026-103668

{
  "etk_id": "ETK-2026-866",
  "cve_id": "CVE-2026-103668",
  "display_id": "CVE-2026-103668",
  "ghsa_id": "GHSA-qjqp-9qgx-jwr5",
  "euvd_id": "EUVD-2026-94282",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in Movable Type Site Search",
  "summary": "Movable Type Cloud Edition, Movable Type, and the listed Premium editions are affected through the Site Search feature. An attacker able to access that feature without signing in may cause the application to execute database queries they control.",
  "mitigation": "Disable Site Search or restrict it to authenticated, trusted users until vendor remediation guidance is available. Limit the database account used by Movable Type to only the permissions and network access it requires.",
  "vendor": "Six Apart Ltd.",
  "product": "Movable Type Cloud Edition",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.2.0, <= 9.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Movable Type Cloud Edition",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.0.0, <= 9.0.9",
        ">= 8.8.0, <= 8.8.5",
        ">= 8.0.0, <= 8.0.12"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Movable Type",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.2.0, <= 9.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Movable Type Premium Cloud Edition",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 9.0.0, <= 9.0.9",
        ">= 2.0, <= 2.17"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Movable Type Premium",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
  "epss_score": 0.0044,
  "epss_percentile": 0.3649,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 98.86634938333333,
  "t0_at": "2026-10-07T10:19:10.413000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T10:19:10.413000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T10:19:10.413000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-103668"
    }
  }
}