CVE-2026-9082-Drupal-PoC

CVE-2026-9082 - Drupal Core PostgreSQL SQL Injection PoC 개요 이 저장소는 CVE-2026-9082 에 대한 윤리적 개념 증명PoC입니다. 이는 Drupal Core 의 매우 중요 한 SQL 인젝션 취약점으로, Drupal 8.0부터 11.3.9까지 실행되는 모든 PostgreSQL 기반 사이트에 영향을 미칩니다. 이 결함은 PostgreSQL 엔티티 쿼리 조건 핸들러에 존재하며, 익명인증되지 않은 사용자 가 Drupal 9부터 기본적으로 활성화된 JSON:API 모듈을 통해 악용할...

cve-2026-9082-drupal-postgresql-rce

CVE-2026-9082 Drupal PostgreSQL SQLi를 RCE로 이 저장소에는 Ambionics 기사에서 설명된 Drupal JSON:API PostgreSQL SQL 인젝션을 위한 로컬 랩과 간단한 익스플로잇이 포함되어 있습니다. 익스플로잇의 중요한 부분은 PostgreSQL 권한 상승입니다: 인젝션이 PostgreSQL 슈퍼유저로 SELECT 표현식을 평가할 수 있게 되면, 대형 객체를 통해 네이티브 프리로드 라이브러리를 작성하고, postgresql.auto.conf를 다시 로드하며,...

CVE-2026-9082

CVE-2026-9082 / Drupal SA-CORE-2026-004 개념 증명 면책 조항: 이 개념 증명은 교육 및 연구 목적으로만 제공됩니다. 소유권이 없거나 명시적인 테스트 허가를 받지 않은 시스템에 대해 이 소프트웨어를 사용하지 마십시오. 저자는 이 프로젝트로 인한 오용 또는 손해에 대해 책임을 지지 않습니다. 개요 A Proof-of-Concept poc.py of CVE-2026-9082 Drupal SA-CORE-2026-004는 Drupal 코어의 치명적인 SQL 인젝션 취약점으로, Drupal이...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL 인젝션 대량 스캐너 & 익스플로잇 도구 Drupal 코어PostgreSQL의 인증이 필요 없는 SQL 인젝션 PDO 플레이스홀더 이름 악용을 통한 JSON:API 필터 배열 키 주입 개요 CVE-2026-9082 는 Drupal 코어 에서 Drupal 8.011.3.9 을 실행하는 모든 PostgreSQL 기반 사이트에 영향을 미치는 매우 치명적인Highly Critical SQL 인젝션 취약점입니다. 2026-05-22에 CISA 알려진 악용 취약점KEV...

DRUPAL-CONTRIB-2026-165

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...

Webform - Less critical - Access bypass - SA-CONTRIB-2026-165

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. When Webform is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. If a webform is configured so that...

PT-2026-97661

Name of the Vulnerable Software and Affected Versions Drupal Webform module affected versions not specified Description When the Webform module is used with JSON:API enabled, submissions may be cached without varying correctly by the authenticated user. This occurs when a webform is configured to...

CVE-2026-61534

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

CVE-2026-61534 Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

EUVD-2026-77579

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables in src/yayson/store.ts and src/yayson/legacy-store.ts. A document whose type i...

GHSA-325J-MG25-8Q58 yayson: Prototype pollution in Store/LegacyStore deserialization

Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...

yayson: Prototype pollution in Store/LegacyStore deserialization

Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...

PT-2026-90549

Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: " proto " writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...

DRUPAL-CONTRIB-2026-127

This module enables you to restrict access to JSON:API routes based on specific user roles. The module doesn't sufficiently enforce access controls under scenarios where a request mimics an XMLHttpRequest...

DRUPAL-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

Entity API - Moderately critical - Information disclosure - SA-CONTRIB-2026-113

The Entity API module extends the Drupal core entity API to provide a unified way to deal with entities and their properties. The module doesn't correctly apply access controls for JSON:API entity collection endpoints. This exposes an information disclosure vulnerability. This vulnerability is...

PT-2026-82362

Name of the Vulnerable Software and Affected Versions Entity API versions 0.0.0 through 1.8.0 Description An incorrect authorization issue in the Entity API allows forceful browsing. The module fails to correctly apply access controls for JSON:API entity collection endpoints, leading to an...

CVE-2026-49858: Use of Cache Containing Sensitive Information

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. ApiPropertysecurity: ... is evaluated per request...

CVE-2026-57954 Elide 7.1.17 - Permission Bypass in Sort Expression Validation

Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across...