CVE-2018-7600

CVE-2018-7600 Drupal CVE-2018-7600 RCE에 대한 개념 증명 익스플로잇 의사 셸 및 프록시 지원 포함...

fad-checker

fad-checker AKA F ormidable A uditor's D ependency C hecker AKA F uckin' A utonomous D ependency C hecker fad-checker is a polyglot dependency auditor built for professional code audits. It scans 10 ecosystems + 9 CMS/Frameworks WordPress, Drupal, Symfony, Laravel… in one pass, with no build tool...

Audit-BlackBox-Web-to-Root

Pentest Lab : 웹 및 시스템 공격 체인 Drupal to Root Disclaimer 이 프로젝트는 교육 및 학술 목적으로 통제되고 격리된 실험실 환경 에서 수행되었습니다. 실제 인프라는 대상으로 삼지 않았습니다. 목표는 공격 메커니즘을 이해함으로써 시스템을 보호하는 방법을 배우는 것입니다. 작업 환경 및 목표 시나리오 이 프로젝트의 목표는 블랙박스Black Box 감사 를 수행하는 것입니다. 즉, 분석은 대상에 대한 사전 지식 없이 시작됩니다. 어떠한 식별자, 기술 문서, 소스 코드도 제공되지 않았습니다. 랩 아키...

CVE-2026-107252

A Drupal module that integrates the MathJax library for LaTeX rendering is vulnerable because it ships with configurations that do not escape JavaScript within the TeX it formats. To mitigate this risk, users should upgrade to the latest version, which updates CDN URLs and adds system status warn...

CVE-2026-107262

The Advanced Filesystem: Backup submodule of Drupal is vulnerable to a Cross-Site Request Forgery (CSRF) flaw due to insufficient validation of certain requests. This could allow an attacker to trick an authenticated user into performing unintended actions. The impact is limited to environments w...

CVE-2026-96389

The Drupal Audit module fails to sufficiently check entity access when rendering an entity through the display-mode example route . This flaw allows an attacker to view content that is unpublished or otherwise access-restricted. However, the impact is partially mitigated because field-level acces...

CVE-2026-107250

Technical details for CVE-2026-107250 are not publicly available in the provided documents. Action: monitor for updates.

CVE-2026-107253

Technical details for CVE-2026-107253 are not publicly available in the provided documents. Action: monitor for updates.

PT-2026-107743

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

PT-2026-107748

This module enables you to restrict access to routes by IP address. The module doesn't reliably restrict a subset of dynamic routes, leading to an access bypass vulnerability. The impact depends on how a site uses this module and whether it has any routes that are dynamic...

PT-2026-107766

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the email example submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, th...

PT-2026-107742

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

PT-2026-107753

Advanced File System turns Drupal's file storage into a manageable, observable and maintainable subsystem. The Advanced Filesystem: Backup submodule does not sufficiently validate certain requests. This may allow an attacker to trick an authenticated user into performing unintended actions throug...

PT-2026-107765

This module enables you to restrict view access to single nodes via taxonomy terms. The module doesn't sufficiently check access rights when in "Permission mode" and a node referencing a deleted taxonomy term is accessed via JSON:API. This vulnerability is mitigated by the fact that it requires a...

PT-2026-107746

The Drupal Security Team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, read the documentation on becoming the maintainer of a project that is unsupported for security...

PT-2026-107764

This module enables you to configure a WIKI-like input filter that allows users to create links to site and external content. The module doesn’t sufficiently prevent page titles being viewed for certain privately-accessible URLs. This vulnerability is mitigated by the fact that an attacker must...

PT-2026-107762

The module Country provides a dedicated field type for Drupal core's official country list. The module does not sufficiently escape user input in its autocomplete widget, which can lead to a cross site scripting vulnerability. This vulnerability is mitigated by the fact that it can not occur out ...

PT-2026-107747

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

PT-2026-107760

This module enables you to add HTML attributes to menu links and their container elements . The module doesn't sufficiently sanitize the attributes it applies to menu link container elements. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions...

PT-2026-107763

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" term hierarchy must be...