Payload CMS Payload

Payload CMS Payload: Unrestricted File Upload

Payload: Prototype pollution in Payload Import Export plugin

Payload authentication token field handling issue

Payload: RCE in Payload Form Builder

Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

Payload: SQL Injection in SQLite and Postgres

Payload: Unauthorized update to collection documents

Payload: Remote Code Execution through first-register

Payload: ReDoS in Multipart Content-Type Validation

Payload: Insufficient Access Control in Stripe REST Proxy

Payload: Incomplete validation during the upload file lifecycle

Payload: Field access control bypass on auth collections

Payload: Order confirmation validation issue in Payload Ecommerce

Payload: SQL injection in SQLite/Postgres

Payload: Bypassed sanitization of user uploaded SVGs

Payload: Improper access control for MCP API keys

Payload: API key disclosure through ordinary document reads

Payload: Unauthenticated account-lockout denial of service

Payload: Uploaded XML files could execute same-origin JavaScript

Payload external upload trust validation issue

Payload: Field-level password update restrictions were not enforced

Payload relationship-query authorization bypass

Payload: Sort queries could expose protected field information

Payload: Token refresh and password reset responses may expose restricted user fields

Payload: Field-level write access bypass in Payload on MongoDB