CMSScan

CMSScan 扫描WordPress、Drupal、Joomla、vBulletin网站的安全问题。 用 在印度制作 CMSScan 为CMS安全扫描提供了一个集中的安全仪表板。它由 wpscan、droopescan、vbscan 和 joomscan 驱动。它支持按需扫描和定期扫描，并具有发送电子邮件报告的能力。 安装 需要 ruby, ruby-dev, gem, libwww-perl, python3.6+ 和 git git clone https://github.com/ajinabraham/CMSScan.git cd CMSScan ./setup.sh 运行...

CVE-2018-7600-Drupal-0day-RCE

CVE-2018-7600-Drupal-0day-RCE Drupal 0day 远程 PHP 代码执行 Perl 这是一个针对 Drupal CMS 的 0day RCE 利用工具。 你可以在服务器上上传有效载荷。 CVE : CVE-2018-7600 Cxsecurity : https://cxsecurity.com/issue/WLB-2018040108 如何运行利用工具： 1-git clone https://github.com/dr-iman/CVE-2018-7600-Drupal-0day-RCE.git 2-安装 ActivePerl 3-perl...

CVE-2018-7600-Remote-Code-Execution

Drupalgeddon2 Python 漏洞利用工具 CVE-2018-7600 本仓库包含一个基于 Python 的概念验证漏洞利用脚本，针对 Drupal 中的关键远程代码执行漏洞，即 Drupalgeddon2 CVE-2018-7600。该脚本仅用于教育目的及安全专业人员在授权渗透测试场景中使用。 📜 免责声明 此工具仅供合法和道德目的使用。未经所有者明确许可，在任何系统上使用此脚本是非法的。作者和贡献者不对因使用此脚本造成的任何滥用或损害负责。使用风险自负。 漏洞详情 CVE ID : CVE-2018-7600 描述 : 在 Drupal 版本 7.58、8.3.9、8.4...

CMSmap

CMSmap CMSmap 是一个 Python 开源 CMS 扫描器，能够自动化检测主流内容管理系统（CMS）的安全漏洞。其核心目标是将不同 CMS 类型的常见漏洞整合到单一工具中。 目前，CMSmap 支持的 CMS 包括 WordPress、Joomla、Drupal 和 Moodle。 请注意，该项目尚处于早期阶段。因此，您可能会遇到错误、缺陷或功能异常。 请自行承担使用风险！ 预览 https://asciinema.org/a/MELa2nUcrtATqnDLnc0ig8rcT 安装 您可以通过克隆 GitHub 仓库来下载最新版本的 CMSmap： git clone...

drupwn

Drupwn v1.0.4 描述 Drupwn 声称提供了一种高效收集 Drupal 信息的方式。 枚举 利用 更多说明请查看我们的博客文章。 支持的测试版本 Drupal 7 Drupal 8 执行模式 Drupwn 可以通过两种独立的模式运行：枚举 和 利用 。 枚举模式用于执行信息收集，而利用模式用于检查并利用 CVE 漏洞。 功能 枚举模式 用户枚举 节点枚举 默认文件枚举 模块枚举 主题枚举 Cookie 支持 User-Agent 支持 基本认证支持 请求延迟 枚举范围 日志记录 Socks 和 HTTP 代理支持 利用模式 漏洞检查器 CVE 利用器 安装 pip3...

CVE-2018-7600

重要提示： 仅用于教育或信息目的。 ModSecurity的保护规则 by fuzzylogic ModRewrite .htaccess的保护规则 致媒体： 请不要在您的文章中将此仓库链接发布，而不说明如何防御攻击（建议更新Drupal、设置WAF规则等）。 基于CheckPoint文章的PoC。 https://research.checkpoint.com/uncovering-drupalgeddon-2/ 作者：Eyal Shalev、Rotem Reiss 和 Eran Vaknin PoC在Drupal 7.x上无效。Drupal 7.x和8.x请参见此处。...

CVE-2018-7600-Drupal-RCE

CVE-2018-7600 Drupal远程代码执行 感谢以下贡献者： 文件| Drupal版本| 来源| 备注 ---|---|---|--- poc0-curl.sh| 8| https://twitter.com/ibo0om/status/984674893768921089 https://twitter.com/IamSecurity/status/984977193565646848 https://gist.github.com/g0tmi1k/7476eec3f32278adc07039c3e5473708| poc1-a2u.py| 8|...

DRUPAL-CONTRIB-2026-217

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

DRUPAL-CONTRIB-2026-216

This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic...

DRUPAL-CONTRIB-2026-214

This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API. This vulnerability is mitigated by the fact that it requires a...

DRUPAL-CONTRIB-2026-213

This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs. This vulnerability is mitigated by the fact that an attacker must...

DRUPAL-CONTRIB-2026-212

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" term\hierarchy must be...

DRUPAL-CONTRIB-2026-209

This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...

DRUPAL-CONTRIB-2026-208

The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API. The module does not correctly check access for all of its endpoints, leading to a potential...

DRUPAL-CONTRIB-2026-206

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or...

DRUPAL-CONTRIB-2026-205

This module enables you to "share" a view display within another website via an iframe. The module doesn't sufficiently block access to view displays. Although the views data is not displayed, resource-intensive views could still be executed which could affect site performance. This vulnerability...

DRUPAL-CONTRIB-2026-204

The Leaflet module provides integration with the Leaflet JS mapping library. Under certain circumstances, when the Leaflet field formatter builds a map it does not filter content titles, leading to a stored cross-site scripting vulnerability. This vulnerability is mitigated by the fact an attacke...

DRUPAL-CONTRIB-2026-202

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module does not sufficiently check entity access in several editor endpoints. This vulnerability is mitigated by the fact that an attacker must have a role with the “use gutenberg” permission...

DRUPAL-CONTRIB-2026-201

This module provides TOTP-based two-factor authentication 2FA for Drupal, with an optional setting to enforce 2FA for all users site-wide. The module may allow a user log in with only a password even when site-wide enforcement of 2FA is turned on...

DRUPAL-CONTRIB-2026-200

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site...