Drupal Views Megarow Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability in the Drupal Views Megarow module allows remote attackers to bypass security restrictions and perform unauthorized operations...

Drupal Fieldable Panels Panes (FPP) Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in Drupal Fieldable Panels Panes FPP, which allows remote attackers to exploit the vulnerability to inject malicious script or...

Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution

array "coderupgrade" = array "module" = "color", "files" = array"color.module" , "extensions" = array"module", "items" = array array"olddir"="test; $cmd;", "newdir"="test", "paths" = array "modulesbase" = "../../../", "filesbase" = "../../../../sites/default/files" ; $payload = serialize$a;...

Drupal Module Coder < 7.x-1.3 / 7.x-2.6 - Remote Code Execution (SA-CONTRIB-2016-039)

Exploit for php platform in category remote exploits array "coderupgrade" = array "module" = "color", "files" = array"color.module" , "extensions" = array"module", "items" = array array"olddir"="test; $cmd;", "newdir"="test", "paths" = array "modulesbase" = "../../../", "filesbase" =...

Drupal Module Coder 7.x-1.37.x-2.6 - Remote Code Execution

Drupal Module Coder 7.x-1.37.x-2.6 - Remote Code Execution array "coderupgrade" = array "module" = "color", "files" = array"color.module" , "extensions" = array"module", "items" = array array"olddir"="test; $cmd;", "newdir"="test", "paths" = array "modulesbase" = "../../../", "filesbase" =...

Drupal Login one time 'Ajax Callback' module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. login one time is one of the modules used to send one-time login link emails to users. A cross-site scripting vulnerability exists in the Drupal Login one time module in versions 7.x-2...

Multiple vulnerabilities in Drupal HybridAuth Social Login module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.HybridAuth Social Login is one of the modules that uses social network accounts to log in and register with the Drupal system. An information disclosure and open redirection vulnerabili...

Drupal Boost Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Boost is one of the modules that improves the performance of a website by optimizing page caching of static files for anonymous users. An information disclosure vulnerability exists in...

Drupal Fast Autocomplete Module Remote Denial of Service Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Fast Autocomplete is one of the modules used to quickly create configurable view patterns. A remote denial of service vulnerability exists in version 7.x-1.x of the Drupal Fast...

Drupal Commerce Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. commerce is one of the e-commerce modules. An information disclosure vulnerability exists in version 7.x-1.x of the Drupal Commerce module before 7.x-1.13. An attacker can exploit this...

Drupal Scald File Module Remote Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Scald File is one of the modules used to handle multimedia. A remote code execution vulnerability exists in the Drupal Scald File module, version 7.x-1.x prior to 7.x-1.2. An attacker...

Drupal Node Embed Module Remote Denial of Service Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node Embed is one of the node modules used to integrate CKEditor's input filters into the content editor and embed them within the body of the article. A remote denial of service...

Drupal XML Sitemap Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. XML Sitemap is one of the modules that makes it easy for search engines to intelligently index Drupal. A cross-site scripting vulnerability exists in Drupal XML Sitemap versions 7.x-2....

Drupal 8.x < 8.1.7 PHP HTTP_PROXY Environment Variable Namespace Collision Vulnerability (httpoxy)

The version of Drupal running on the remote web server is 8.x prior to 8.1.7. It is, therefore, affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTPPROXY environment variable ...

Multiple vulnerabilities in Drupal REST JSON module

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.REST JSON is one of the interface modules used to expose Drupal content. The Drupal REST JSON module version 7.x-1.x has a 1. security bypass vulnerability 2. user enumeration...

Drupal Page Manager Search Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Page Manager Search is one of the modules that provides page search capabilities through the Drupal core search module. An information disclosure vulnerability exists in versions 7.x-1....

drupal: proxy injection

Drupal 8 uses the third-party PHP library Guzzle for making server-side HTTP requests. An attacker can provide a proxy server that Guzzle will use. This vulnerability is called 'httpoxy'. httpoxy is a set of vulnerabilities that affect application code running in CGI, or CGI-like environments. It...

Drupal RESTWS Module Remote PHP Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Drupal RESTWS Module Remote PHP Code Execution', 'Description' = %q This module exploits a Remote PHP Code Execution vulnerability in Drupal RESTW...

Drupal Opening Hours Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. opening hours is one of the modules used to find stores or libraries that are open at a certain time. A cross-site scripting vulnerability exists in the Drupal Opening Hours module in...

Drupal Module RESTWS 7.x - PHP Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Drupal RESTWS Module 7.x Remote PHP Code Execution', 'Description' = %q This module exploits the Drupal RESTWS module...