CVE-2026-9082-Drupal-PoC

CVE-2026-9082 - Drupal Core PostgreSQL SQL Injection PoC Overview This repository provides an ethical Proof-of-Concept PoC for CVE-2026-9082 , a Highly Critical SQL injection vulnerability in Drupal Core affecting all PostgreSQL-backed sites running Drupal 8.0 through 11.3.9. The flaw resides in...

drupal-oembed-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · drupal-oembed-ssrf drupal-oembed-ssrf Class: SSRF Reach: Remote Drupal core 11.4.8 61044508 - Drupal SA-CORE-2026-008 gated the discovery document host with mediaoembeddiscoverytrustedhostpatterns. UrlResolver::findUr...

drupal-cve-2026-9082-checker

DRUPAL CVE-2026-9082 CHECKER Drupal CVE-2026-9082 Blind SQL Injection Checker Installation git clone https://github.com/N45HT/drupal-cve-2026-9082-checker.git cd drupal-cve-2026-9082-checker pip install -r requirements.txt References https://vulners.com/cve/CVE-2026-9082...

drupal-move-block-markup

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · drupal-move-block-markup drupal-move-block-markup Class: Stored XSS Reach: Remote Drupal core 11.4.8 61044508 - Drupal SA-CORE-2026-012 switched the current Move Block row to t'@label current', which Html::escapes...

CVE-2018-7602

CVE-2018-7602 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - High...

Drupalgedon3

POC for Drupal exploit SA-CORE-2018-004 / CVE-2018-7602 Author Alexandre Nguyen Usage usage: exploit.py -h --command --nodeid --url POC for Drupal vulnerability SA-CORE-2018-004 arguments: -h, --help show this help message and exit --command Command to inject --nodeid Node to target --url Drupal...

CVE-2020-13671-old

CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...

CVE-2020-13671

CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...

CVE-2026-PoCs

💀 Exploit-Index: The Ultimate CVE Proof of Concept PoC & Exploit Database 150,000+ Verified Exploits & PoCs for Cybersecurity Research All In One Place Explore the Interactive Portal • View the JSON Index • Browse CVEs 📖 Abo...

CVE-2018-7600-Remote-Code-Execution

Drupalgeddon2 Python Exploit CVE-2018-7600 This repository contains a Python-based proof-of-concept exploit for the critical remote code execution vulnerability in Drupal, known as Drupalgeddon2 CVE-2018-7600. This script is designed for educational purposes and for security professionals to use ...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & Exploitation Tool Unauthenticated SQL Injection in Drupal Core PostgreSQL JSON:API filter array key injection via PDO placeholder name abuse Overview CVE-2026-9082 is a Highly Critical SQL injection vulnerability in Drupal Core...

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

CVE-2018-7600

POC of CVE-2018-7600 Drupal RCE CVE-2018-7600 Dont Forget to Put Your Adress into the Script ! Description: A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which...

CVE-2026-9082

CVE-2026-9082 Unauthenticated SQL injection in Drupal Core on PostgreSQL via POST /user/login, escalated to remote code execution through PostgreSQL sessionpreloadlibraries. Unlike existing public exploits that target JSON:API, this uses the login endpoint — always available, no modules or...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL Injection Vulnerability in Drupal Core High-Impact SQL Injection Vulnerability in Drupal Core PostgreSQL 📋 Overview CVE-2026-9082 is a SQL Injection vulnerability in Drupal Core’s database abstraction layer. It affects only sites using PostgreSQL as the database backend. The...

CVE-2026-9082

CVE-2026-9082 / Drupal SA-CORE-2026-004 Proof of Concept Disclaimer: This Proof-of-Concept is for educational and research purposes only. Do not use this software against any system you do not own or have explicit permission to test. The author assumes no liability for misuse or damage caused by...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...

Drupal Core 12.0.0-beta1 Field UI Remote Code Execution Detection Tool

Drupal Core versions containing the Field UI module are vulnerable to remote code execution. This tool performs read-only version and Field UI checks to identify potentially affected installations...

DRUPAL-CORE-2026-015

The Drupal core Link module provides a field type that can be used for internal and external URLs. The module does not sufficiently sanitize certain markup in some circumstances, which can lead to cross-site scripting XSS vulnerabilities...

DRUPAL-CORE-2026-014

A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code ma...