DRUPAL-CONTRIB-2026-091

An advisory for this issue has been issued at and an additional issue was identified and fixed via This module is now resupported. See that advisory for more details. Original content The security team is marking this project unsupported. There is a known security issue with the project that has...

Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

Disable Login Page - Critical - Unsupported - SA-CONTRIB-2026-091

An advisory for this issue has been issued at https://www.drupal.org/sa-contrib-2026-110 and an additional issue was identified and fixed via https://www.drupal.org/sa-contrib-2026-111 This module is now resupported. See that advisory for more details. Original content The security team is markin...

Drupal 7 Elfinder - Unauthenticated Connector Exposure Detection

Identifies Drupal sites with the elfinder library installed, which could be vulnerable to unrestricted file upload through the connector.php file.When this component is detected, the site may be vulnerable to remote code execution attacks via PHP file uploads.This template only detects the presen...

Drupal Avatar Uploader - Cross-Site Scripting Detection

Drupal Avatar Uploader v7.x-1.0-beta8 plugin contains a cross-site scripting vulnerability in the slider import search feature and tab parameter via plugin settings. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Avatar Uploader v7.""" from kittysploit import from lib.protocols.http.httpclie...

Drupal User Enumration [Ajax] Detection

Detects Drupal User Enumration Ajax. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Drupal User Enumration Ajax.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Drupal User Enumration Ajax Detection',...

Drupal Install Detection

Drupal Install panel exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Install panel exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Drupal Install Detection', 'description': 'Drupal Install panel...

Drupal JSON:API Username Listing - Detect

Drupal JSON:API username listing was detected via the /user/user endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal JSON:API username listing was detected via the /user/user endpoint.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Drupal User Enumeration [Redirect] Detection

Detects Drupal User Enumeration Redirect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Drupal User Enumeration Redirect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Drupal User Enumeration...

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion Detection

In avataruploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """In avataruploader v7.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Drupal - Remote Code Execution Detection

Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal 8.""" from kittysploit import from...

Drupal - Source Code Disclosure Detection

Detected exposed Drupal source code, backup files, and sensitive configurations, potentially disclosing database credentials and API keys. This exposure revealed internal system paths and critical site metadata, increasing the risk of full system compromise. !/usr/bin/env python3 -- coding: utf-8...

Drupal - Remote Code Execution Detection

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal before 7.""" impor...

Drupal 11.x-dev - Full Path Disclosure Detection

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. !/usr/bin/env python3 -- coding: utf-8 -- """core/authorize.""" from kittysploit import from lib.protocols.http.httpclient...

Drupal CVE-2026-9082 PostgreSQL SQLi Detect

Detects CVE-2026-9082 SA-CORE-2026-004 on PostgreSQL-backed Drupal via JSON:API filter value array keys. Confirms the blind error oracle: injected key 0||1/CASE WHEN 1=1 THEN 0 ELSE 1 END yields HTTP 500, 1=0 yields HTTP 200 on GET /jsonapi/type?filteracondition... !/usr/bin/env python3 -- coding...

Drupal PostgreSQL SQLi (CVE-2026-9082)

CVE-2026-9082 SA-CORE-2026-004: PostgreSQL-only blind SQL injection via JSON:API filter value array keys or POST /user/login name keys. translateCondition concatenates the key into a PDO placeholder; 0||1/CASE WHEN predicate THEN 0 ELSE 1 END turns true predicates into HTTP 500 divisionbyzero and...

DRUPAL-CONTRIB-2026-089

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...

DRUPAL-CONTRIB-2026-088

The Photoswipe Drupal module provides integration for the widely used PhotoSwipe lightbox library to display / zoom images in lightbox galleries using the provided image formatters. The module didn't sufficiently check access permissions, when viewing an image using the photoswipe image gallery...

DRUPAL-CONTRIB-2026-087

This module enables you to retrieve and submit webform submissions via REST endpoints. The module doesn't sufficiently check the parent webform's permissions for creating, viewing and updating permissions. This vulnerability is mitigated by the fact that an attacker must already have permissions ...

DRUPAL-CONTRIB-2026-086

The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466s-becoming-owner-maintainer-or-co-mai...