CVE-2026-9082-Drupal-PoC

CVE-2026-9082 - Drupal Core PostgreSQL SQL Injection PoC Overview This repository provides an ethical Proof-of-Concept PoC for CVE-2026-9082 , a Highly Critical SQL injection vulnerability in Drupal Core affecting all PostgreSQL-backed sites running Drupal 8.0 through 11.3.9. The flaw resides in...

cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi to RCE This repository contains a local lab and a short exploit for the Drupal JSON:API PostgreSQL SQL injection described in the Ambionics article. The important part of the exploit is the PostgreSQL escalation: once the injection can evaluate a SELECT...

CVE-2026-9082

CVE-2026-9082 / Drupal SA-CORE-2026-004 개념 증명 면책 조항: 이 개념 증명은 교육 및 연구 목적으로만 제공됩니다. 소유권이 없거나 명시적인 테스트 허가를 받지 않은 시스템에 대해 이 소프트웨어를 사용하지 마십시오. 저자는 이 프로젝트로 인한 오용 또는 손해에 대해 책임을 지지 않습니다. 개요 A Proof-of-Concept poc.py of CVE-2026-9082 Drupal SA-CORE-2026-004는 Drupal 코어의 치명적인 SQL 인젝션 취약점으로, Drupal이...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL 인젝션 대량 스캐너 & 익스플로잇 도구 Drupal 코어PostgreSQL의 인증이 필요 없는 SQL 인젝션 PDO 플레이스홀더 이름 악용을 통한 JSON:API 필터 배열 키 주입 개요 CVE-2026-9082 는 Drupal 코어 에서 Drupal 8.011.3.9 을 실행하는 모든 PostgreSQL 기반 사이트에 영향을 미치는 매우 치명적인Highly Critical SQL 인젝션 취약점입니다. 2026-05-22에 CISA 알려진 악용 취약점KEV...

DRUPAL-CONTRIB-2026-165

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...

Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...

PT-2026-97661

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to...

CVE-2026-61534

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

EUVD-2026-77579

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

GHSA-325J-MG25-8Q58 yayson: Prototype pollution in Store/LegacyStore deserialization

Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...

yayson: Prototype pollution in Store/LegacyStore deserialization

Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...

PT-2026-90549

Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: " proto " writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...

DRUPAL-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

PT-2026-82362

Name of the Vulnerable Software and Affected Versions Entity API versions 0.0.0 through 1.8.0 Description An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an...

CVE-2026-49858: Use of Cache Containing Sensitive Information

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. ApiPropertysecurity: ... is evaluated per request...

CVE-2026-57954 Elide 7.1.17 - Permission Bypass in Sort Expression Validation

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across...