{"id":"CVE-2026-103668","title":"An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.","summary":"An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cwe":["CWE-89"],"vendor":"Six Apart Ltd.","product":"Movable Type Cloud Edition","affected":["movable_type_cloud_edition >= 9.2.0 <= 9.2.1","movable_type >= 9.0.0 <= 9.0.9","movable_type >= 8.8.0 <= 8.8.5","movable_type >= 8.0.0 <= 8.0.12","movable_type_premium_cloud_edition >= 9.2.0 <= 9.2.1","movable_type_premium >= 9.0.0 <= 9.0.9","movable_type_premium >= 2.0 <= 2.17"],"published":"2026-10-07","updated":"2026-10-07","sourceUpdated":"2026-10-07T11:17:09.357","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-103668","references":[{"url":"https://jvn.jp/en/jp/JVN91153973/","label":"vultures@jpcert.or.jp"},{"url":"https://movabletype.org/news/2026/10/mt-930-released.html","label":"vultures@jpcert.or.jp"},{"url":"https://www.sixapart.jp/movabletype/news/2026/10/07-1100.html","label":"vultures@jpcert.or.jp"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-07T11:26:47.654Z","slug":"CVE-2026-103668","body":"## Overview\n\nAn SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}