drupal-cve-2018-7600-poc

README Drupal Drupalgeddon 2 인증되지 않은 원격 코드 실행 CVE-2018-7600 Drupal 7.58 이전 버전, 8.3.9 이전의 8.x 버전, 8.4.6 이전의 8.4.x 버전, 8.5.1 이전의 8.5.x 버전은 Form API를 포함한 기본 또는 공통 모듈 구성을 사용하는 여러 하위 시스템에 영향을 미치는 문제로 인해 원격 공격자가 임의 코드를 실행할 수 있도록 허용한다. 참고문헌: https://www.drupal.org/sa-core-2018-002...

drupalgeddon2-CVE-2018-7600

Drupal - Drupalgeddon2 CVE-2018-7600 root@kitploit: $ python3 drupalgeddon.py -h + drupalgeddon2 CVE-2018-7600 エクスプロイト by Rafael Caria 使用法: drupalgeddon.py -h --url URL --command COMMAND --function FUNCTION --test --proxy PROXY ! このスクリプトは、Forms API における Drupal のプロパティインジェクション CVE-2018-7600...

CVE-2025-11437

A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This issue is currentl...

CVE-2025-11437 JhumanJ OpnForm Form Editor forms cross site scripting

A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. This issue is currentl...

EUVD-2007-6287

Malware in sbrugna...

EUVD-2007-4047

Malware in sbrugna...

Drupal Drupalgeddon 2 Forms API Property Injection Exploit

This Metasploit module exploits a Drupal property injection in the Forms API. Drupal versions 6.x, less than 7.58, 8.2.x, less than 8.3.9, less than 8.4.6, and less than 8.5.1 are vulnerable. This module requires Metasploit: https://metasploit.com/download Current source:...

Drupal Drupalgeddon 2 Forms API Property Injection

This module exploits a Drupal property injection in the Forms API. Drupal 6.x, use exploit/unix/webapp/drupal/drupalgeddon2 msf undefineddrupalgeddon2 show actions ...actions... msf undefineddrupalgeddon2 set ACTION msf undefineddrupalgeddon2 show options ...show and set options... msf...

Moodle 1.9.x < 1.9.14 Multiple Vulnerabilities

Binary data 8711.prm...

Moodle 2.0.x < 2.0.5 / 2.1.x < 2.1.2 Multiple Vulnerabilities

Binary data 8713.prm...

Drupal 6.x < 6.31 Forms API Information Disclosure

The remote web server is running a version of Drupal that is 6.x prior to 6.31. It is, therefore, affected by an error related to the HTML form API and the caching of pages for different anonymous users, which could allow sensitive information to be disclosed. Note that Drupal core does not expos...

Drupal 7.x < 7.27 Forms API Information Disclosure

The remote web server is running a version of Drupal that is 7.x prior to 7.27. It is, therefore, affected by an error related to the HTML form API and the caching of pages for different anonymous users, which could allow sensitive information to be disclosed. Note that Drupal core does not expos...

CVE-2011-4301

The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant...

Debian DSA-2338-1 : moodle - several vulnerabilities

Several cross-site scripting and information disclosure issues have been fixed in Moodle, a course management system for online learning : - MSA-11-0020 Continue links in error messages can lead offsite - MSA-11-0024 reCAPTCHA images were being authenticated from an older server - MSA-11-0025 Gro...

DSA-2338-1 moodle - several

Bulletin has no description...

Cross site request forgery (csrf)

The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery CSRF attacks and delete custom editor interfaces...

CVE-2007-6320

Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery CSRF attacks...

CVE-2007-5594

Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery CSRF attack...

Cross site request forgery (csrf)

Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery CSRF attack...

SA-2007-029 - Drupal core - User deletion cross site request forgery

The Drupal Forms API protects against cross site request forgeries CSRF, where a malicous site can cause a user to unintentionally submit a form to a site where he is authenticated. The user deletion form does not follow the standard Forms API submission model and is therefore not protected again...