Hackrate

Low-privilege RCE through element-search eager loading

Arbitrary user password reset leading to administrator account takeover

Authenticated SQL Injection via nested eager-loading criteria

GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

Authenticated RCE through Twig sandbox escape

Authenticated RCE via `condition.config` JSON cleanse bypass