17700 matches found
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
This module enables you to share content between sites in a hub - subscriber model. Certain inputs were not sufficiently validated, allowing an attacker to achieve server-side request forgery attacks...
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity...
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...
PT-2026-75905
This module enables you to view the differences between revisions on any entity type. The module doesn't sufficiently restrict access to non-node entity revision diffs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to view the entity...
PT-2026-76591
Name of the Vulnerable Software and Affected Versions Drupal Quick Tabs versions 0.0.0 through 4.3.1 Description An incorrect authorization issue allows forceful browsing. The module fails to correctly enforce access when rendering node and block tabs by treating neutral access results as grants...
PT-2026-75904
This module enables you to pay for Commerce transactions using Paypal. The module doesn't sufficiently validate the transaction result in certain circumstances, allowing a malicious user to mark transactions placed without payment. This vulnerability only affects sites using the Payflow Link...
PT-2026-75908
This module enables you to display content in tabs, where each tab renders a block, a node, a view, or another Quick Tabs instance. The module did not correctly enforce access when rendering node and block tabs. It treated a neutral access result as a grant for node tabs and block plugins, and...
Drupal - SA-CORE-2014-005 SQLi Detection (CVE-2014-3704)
Detects Drupageddon CVE-2014-3704 by POSTing crafted name0; SELECT ... to the login form and matching mbstrlen warning. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal 7.x SA-CORE-2014-005 SQLi detection CVE-2014-3704.""" from kittysploit import from lib.protocols.http.httpclient import...
Drupal RESTWS - passthru RCE Detection
Detects Drupal RESTWS RCE via /index.php?q=taxonomyvocabulary/X/passthru/id SA-CONTRIB-2016-040. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal RESTWS taxonomyvocabulary passthru RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...
Drupal Coder - coder_upgrade.run.php Exposure Detection
Soft-detects exposed Drupal Coder upgrade script at /sites/all/modules/coder/coderupgrade/scripts/coderupgrade.run.php. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Coder module coderupgrade.run.php exposure SA-CONTRIB-2016-039.""" from kittysploit import from lib.protocols.http.httpclient...
Exploit for Improper Input Validation in Drupal
CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA...
DRUPAL-CONTRIB-2026-094
The Entity Browser module allows you to select entities from entity reference fields using a custom entity browser widget. The module doesn't sufficiently sanitize the the tab titles, resulting in a stored cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an...
DRUPAL-CONTRIB-2026-093
This module provides formatters to allow in-place editing in a View or other display full content, teaser.... The module doesn't sufficiently check access when editing entities. A malicious user could craft requests to allow them to modify any field on any entity. This vulnerability is mitigated ...
Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
📄 Drupal Core 11.3.9 Anonymous Blind SQL Injection
A proof of concept exploit for an anonymous blind SQL injection vulnerability in Drupal Core version 11.3.9. The vulnerability affects Drupal Core versions 8.9.0 through 11.3.9 when using PostgreSQL as the database backend and is caused by improper handling of attacker-controlled array keys while...
K000162772: Drupal vulnerability CVE-2026-9082
Security Advisory Description Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Drupal Drupal core allows SQL Injection. This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0...
CLSA-2026-1785380876 TuxCare security update for drupal/core (4 CVEs)
TuxCare rebuilt drupal/core to address 4 CVEs. Fixed in 8.9.20-p2+tuxcare...