https://hackingpassion.com/tags/ghost-cms/Recent content in Ghost-Cms on HackingPassion.com : root@HackingPassion.com-[~]HugoenTue, 26 May 2026 12:51:20 +0200https://hackingpassion.com/ghost-cms-cve-2026-26980/Tue, 26 May 2026 12:51:20 +0200https://hackingpassion.com/ghost-cms-cve-2026-26980/<p>A <strong>SQL injection vulnerability</strong> in <strong>Ghost CMS</strong> has turned Harvard University, Oxford University, and DuckDuckGo into malware distribution platforms. Visitors arrive at a page they trust completely, a fake Cloudflare verification prompt appears, and their machine gets infected if they follow the instructions. More than <strong>700 sites</strong>. Software that had never had an unauthenticated critical vulnerability in its entire history.</p> <p><strong>Ghost CMS</strong> is publishing software built on Node.js, used for newsletters, membership sites, and independent blogs. It is open source and free to self-host, with a paid hosted version called Ghost Pro. More than <strong>100,000 active installations</strong> and more than <strong>50,000 GitHub stars</strong>.</p>