Low Severity
Published: Nov 5, 2026
# CVE Credits & Security Advisories
Vulnerabilities discovered and responsibly disclosed by [Arkadiusz Marta](https://github.com/arkmarta).
---
### Strapi
- [CVE-2025-3930](https://www.cve.org/CVERecord?id=CVE-2025-3930) - Insufficient Session Expiration via JWT Token Reuse
- [CVE-2026-22707](https://github.com/strapi/strapi/security/advisories/GHSA-pcw7-5633-82vv) - Upload Plugin MIME Validation Bypass via Content API
### Payload CMS
- [CVE-2025-4643](https://www.cve.org/CVERecord?id=CVE-2025-4643) - Insufficient Session Expiration via JWT Token Reuse
- [CVE-2025-4644](https://www.cve.org/CVERecord?id=CVE-2025-4644) - Session Fixation in SQLite Adapter
- [CVE-2026-34747](https://github.com/payloadcms/payload/security/advisories/GHSA-7xxh-373w-35vg) - SQL Injection via Query Handling
### QuickCMS
- [CVE-2025-12465](https://cert.pl/en/posts/2025/12/CVE-2025-12465/) - Blind SQL Injection via aFilesDelete Parameter
- [CVE-2026-11860](https://cert.pl/en/posts/2026/06/CVE-2026-11860/) - Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution
### Quick.Cart
- [CVE-2025-67683](https://www.cve.org/CVERecord?id=CVE-2025-67683) - Reflected XSS via sSort Parameter
- [CVE-2025-67684](https://www.cve.org/CVERecord?id=CVE-2025-67684) - Remote Code Execution via Local File Inclusion
### CVAT
- [CVE-2026-23516](https://github.com/cvat-ai/cvat/security/advisories/GHSA-3m7p-wx65-c7mp) - XSS via Skeleton SVG Images
- [CVE-2026-23526](https://github.com/cvat-ai/cvat/security/advisories/GHSA-7pvv-w55f-qmw7) - Privilege Escalation of Users with Staff Status
### AVideo
- [CVE-2026-27568](https://github.com/WWBN/AVideo/security/advisories/GHSA-rcqw-6466-3mv7) - Stored Cross-Site Scripting via Markdown Comment Injection
- [CVE-2026-27732](https://github.com/WWBN/AVideo/security/advisories/GHSA-h39h-7cvg-q7j6) - Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
- [CVE-2026-28501](https://github.com/WWBN/AVideo/security/advisories/