CVE-2026-108099

The Entity List module for Drupal (versions 0.0.0 to 3.0.10 ) is vulnerable to Remote Code Execution (RCE) via Reflection Injection (CWE-470). The root cause is the use of externally-controlled input to select classes or code. While the vulnerability is not directly exploitable using the module a...

EUVD-2026-113553

Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10...