Hackrate

SQL injection leading to privilege escalation

Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE

Unauthenticated payment reuse allows unpaid orders to be marked as paid

Control panel only API response emulation replaces "securityKey" and reaches server RCE

Authenticated RCE via render-components Entry Type overrides

Low-privilege RCE through element-search eager loading

Authenticated SQL Injection via nested eager-loading criteria

GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

Arbitrary user password reset leading to administrator account takeover

Authenticated RCE through Twig sandbox escape