Ghost-Cms — PoC Archivehttps://poc.intelseclab.com/tags/ghost-cms/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Ghost CMS Theme JSONPath Remote Code Execution — CVE-2026-29053https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29053-ghost-cms-jsonpath-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29053-ghost-cms-jsonpath-rce/High severity — web · CVE-2026-29053 (GHSA-cgc2-rcrh-qr5x). Status: PoC. Affects: Ghost CMS. Tags: ghost-cms, rce, jsonpath, static-eval, handlebars, theme-upload, prototype-pollution, nodejs.webHighghost-cmsrcejsonpathstatic-evalhandlebarstheme-uploadprototype-pollutionnodejsGhost CMS Content API — Unauthenticated Blind SQL Injection (CVE-2026-26980)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26980-ghost-cms-blind-sqli/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26980-ghost-cms-blind-sqli/Critical severity — web · CVE-2026-26980. Status: Weaponized. Affects: Ghost CMS. Tags: ghost-cms, sql-injection, blind-sqli, content-api, unauthenticated, boolean-oracle, mysql, sqlite.webCriticalghost-cmssql-injectionblind-sqlicontent-apiunauthenticatedboolean-oraclemysqlsqlite