CVE-2018-7600-Remote-Code-Execution

Drupalgeddon2 Python Exploit CVE-2018-7600 This repository contains a Python-based proof-of-concept exploit for the critical remote code execution vulnerability in Drupal, known as Drupalgeddon2 CVE-2018-7600. This script is designed for educational purposes and for security professionals to use ...

drupal-cve-2026-9082-checker

DRUPAL CVE-2026-9082 CHECKER Drupal CVE-2026-9082 Blind SQL Injection Checker Installation root@kitploit: git clone https://github.com/N45HT/drupal-cve-2026-9082-checker.git cd drupal-cve-2026-9082-checker pip install -r requirements.txt References https://vulners.com/cve/CVE-2026-9082...

CVE-2026-PoCs

CVE-2026-PoCs A community-curated, verified collection of Proof-of-Concept exploits for CVEs disclosed in 2026. Why this repo Most CVE PoC collections are scattered across Twitter threads, gists, and dead blog links. This repo aims to be the single, well-organized, actively maintained index of 20...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL Injection Mass Scanner & Exploitation Tool Unauthenticated SQL Injection in Drupal Core PostgreSQL JSON:API filter array key injection via PDO placeholder name abuse Overview CVE-2026-9082 is a Highly Critical SQL injection vulnerability in Drupal Core...

CVE-2018-7600

POC of CVE-2018-7600 Drupal RCE CVE-2018-7600 Dont Forget to Put Your Adress into the Script ! Description: A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which...

CVE-2018-7602

CVE-2018-7602 Existe una vulnerabilidad de ejecución remota de código en múltiples subsistemas de Drupal 7.x y 8.x. Esto potencialmente permite a los atacantes explotar múltiples vectores de ataque en un sitio Drupal, lo que podría resultar en el compromiso del sitio. Esta vulnerabilidad está...

drupalgeddon2-cve-lab

Drupalgeddon2 CVE-2018-7600 lab This repository is a reusable target package for the Drupalgeddon2 run. Sentinel reproduced CVE-2018-7600 on 2026-08-27 against Drupal core 7.57 with SQLite and PHP 7.4. The exploit is the Drupal 7 two-request AJAX render-array path: 1. poison the user password for...

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...

CVE-2026-9082

CVE-2026-9082 Unauthenticated SQL injection in Drupal Core on PostgreSQL via POST /user/login, escalated to remote code execution through PostgreSQL sessionpreloadlibraries. Unlike existing public exploits that target JSON:API, this uses the login endpoint — always available, no modules or...

CVE-2020-13671

CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...

CVE-2020-13671-old

CVE-2020-13671 RCE via File Upload — Drupal Core Software: Drupal Core 8.7.5 Affected: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — Unrestricted Upload of File with Dangerous Type CISA KEV: Yes — Known Exploited Vulnerability Advisory: SA-CORE-2020-012 What is Drup...

CVE-2026-9082-Drupal-PoC

CVE-2026-9082 - Drupal Core PostgreSQL SQL Injection PoC Overview This repository provides an ethical Proof-of-Concept PoC for CVE-2026-9082 , a Highly Critical SQL injection vulnerability in Drupal Core affecting all PostgreSQL-backed sites running Drupal 8.0 through 11.3.9. The flaw resides in...

Drupalgedon3

POC for Drupal exploit SA-CORE-2018-004 / CVE-2018-7602 Author Alexandre Nguyen Usage root@kitploit: usage: exploit.py -h --command --nodeid --url POC for Drupal vulnerability SA-CORE-2018-004 arguments: -h, --help show this help message and exit --command Command to inject --nodeid Node to targe...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL Injection Vulnerability in Drupal Core High-Impact SQL Injection Vulnerability in Drupal Core PostgreSQL 📋 Overview CVE-2026-9082 is a SQL Injection vulnerability in Drupal Core’s database abstraction layer. It affects only sites using PostgreSQL as the database backend. The...

CVE-2026-9082

CVE-2026-9082 / Drupal SA-CORE-2026-004 Proof of Concept Disclaimer: This Proof-of-Concept is for educational and research purposes only. Do not use this software against any system you do not own or have explicit permission to test. The author assumes no liability for misuse or damage caused by...

CVE-2026-55805

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from...

CVE-2026-15916

Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0., from 0.0.0 to 11.1., from 0.0.0 to 11.2...

CVE-2026-15917

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS. This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.2...

CVE-2026-15916

CVE-2026-15916 is a Missing Authorization vulnerability in the Drupal core Image module that allows forceful browsing, leading to information disclosure. The module does not sufficiently check access to image style derivatives when files are served via a file stream other than private://. The ris...