{"uuid": "c4f737e6-713c-423a-aa22-929c707a38d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-26980", "type": "exploited", "source": "https://t.me/VulnerabilityNews/42658", "content": "Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks\n\nThreat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks.\n\nAccording to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Ghost's Content API that could allow an unauthenticated attacker to read arbitrary data from the\nhttps://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html", "creation_timestamp": "2026-09-19T00:00:45.000743Z"}