Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

The Block AJAX module enables you to load blocks asynchronously via Ajax. The module doesn't sufficiently validate user-supplied data which is used to construct a block. In the worst case scenario, this can lead to PHP Object Injection and Remote Code Execution. The vulnerability is mitigated by...

CVE-2026-107267

The DKAN module for Drupal contains an access bypass vulnerability because it fails to correctly check access permissions for all of its endpoints. This module is used to build open data portals by importing tabular data files into database tables and exposing them via a JSON API . The impact is ...

PT-2026-107758

The DKAN module enables organizations and individuals to build open data portals in Drupal. The DKAN datastore imports tabular data files into database tables and exposes them for querying with a JSON API. The module does not correctly check access for all of its endpoints, leading to a potential...

PT-2026-107747

This module provides TOTP-based two-factor authentication 2FA for Drupal. The module doesn't enforce the second factor when a user logs in with Drupal core's one-time login link. This vulnerability is mitigated by the fact that an attacker must have access to a valid one-time login link for a...

drupalgeddon2-cli

drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...

CVE-2017-9841

CVE-2017-9841 CVE-2017-9841 detector script by Massimiliano Brasile WHAT HAPPENED January 6th, 2020 I was advised of a security issue apparently affecting most versions of PrestaShop the warning was shared by PS team only internally on 3rd January 2020. After some digging, I have discovered the...

cve-2026-9082

CVE-2026-9082 Type : SQL Injection CWE-89 Affected Product : Drupal Core Database Abstraction API Drupal Advisory : SA-CORE-2026-004 Published : May 20, 2026 Severity : Highly Critical Drupal 20/25 | NVD CVSS 6.5 What Is It? CVE-2026-9082 is a SQL Injection vulnerability in Drupal's core database...

web-penetration-drupal

Web Penetration Testing — Drupal CVE-2018-7600 Type: Internship Project | Company: BB CyberSec | Period: Nov 2024 – Jan 2025 📋 Project Overview This project documents a full penetration test conducted on a Drupal web application as part of my cybersecurity internship at BB CyberSec. The assessmen...

CVE-2026-9082

⚠️ Security Research & Legal Disclaimer 📌 Purpose of This Repository This repository is provided strictly for educational, academic, and authorized cybersecurity research purposes only. It is intended to support understanding of: Security vulnerabilities and exploitation concepts in controlled...

CVE-2026-9082

CVE-2026-9082 Unauthenticated SQL injection in Drupal Core on PostgreSQL via POST /user/login, escalated to remote code execution through PostgreSQL sessionpreloadlibraries. Unlike existing public exploits that target JSON:API, this uses the login endpoint — always available, no modules or...

CVE-2018-7600-PoC

SAWPOC — CVE-2018-7600 CVE-2018-7600 용 Python Proof of Concept으로, Drupalgeddon2 라고도 알려져 있습니다. CVE-2018-7600은 특정 버전의 Drupal 7 에 영향을 미치는 치명적인 취약점입니다. 취약한 구성에서 인증되지 않은 공격자가 악성 입력을 주입하고 원격 코드 실행을 달성할 수 있습니다. ⚠️ 면책 조항: 이 프로젝트는 교육 목적, CTF, 보안 연구 및 공인된 침투 테스트 전용입니다. 명시적 허가 없이 시스템에 사용하지 마십시오. 기능 Python 기반...

CVE-2020-13671

CVE-2020-13671 파일 업로드를 통한 RCE — Drupal Core 소프트웨어: Drupal Core 8.7.5 영향: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 높음 CWE: CWE-434 — 위험한 유형의 파일 무제한 업로드 CISA KEV: 예 — 알려진 악용 취약점 보안 권고: SA-CORE-2020-012 Drupal이란 무엇인가 Drupal은 PHP로 작성된 오픈소스 콘텐츠 관리 시스템CMS입니다. WordPress나 Joomla와 유사하지만...

CVE-2020-13671-old

CVE-2020-13671 파일 업로드를 통한 RCE — Drupal Core 소프트웨어: Drupal Core 8.7.5 영향 범위: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 High CWE: CWE-434 — 위험한 유형의 파일 무제한 업로드 Unrestricted Upload of File with Dangerous Type CISA KEV: 예 — 알려진 악용 취약점 Known Exploited Vulnerability Advisory:...

qyvora-anansi

; & ;; ;& ;;; ;;; ; ;;; ;;; ; ;;; ;;; ; ;; ;;; ;;; ;;;; ;;;; ;;; && ;;; ;;;; ;;;; ;;;; ;;;; ;;;;;;;;;; ;;;; ;;;; ;;;;;;;;; ;;;;;;;;;;;;;;;; ;;;;;;;;; &;;;;;;;;;;;;$x;;;;;;;;;;;; ;;;;;;;;;;&&&+++&&&;;;;;;;;;;; ;;;;;;;;; ;;;&&+&&&&&+&&;;; ;;;;;;;;;; ;;;& ;; ;;;&+&&&&&&&+&&;;; ;; &;;; ;;; ;;;;...

cve-2019-6340-bits

cve-2019-6340-bits Bits generated while analyzing CVE-2019-6340 Drupal RESTful RCE modsec rule pcap example nginx config example logs example playbook...

CVE-2018-7600-Drupal-RCE

CVE-2018-7600-Drupal-RCE...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — SSRF / local file read via response URL CVE-2026-13233 Untrusted upstream: the provider that fetched the URL its response told it to. Drupal OpenAI Provider aiprovideropenai · SSRF CWE-918 · CVE-2026-13233 · SA-CONTRIB-2026-053 Status: Coordinated disclosure complete...

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL 인젝션 대량 스캐너 & 익스플로잇 도구 Drupal 코어PostgreSQL의 인증이 필요 없는 SQL 인젝션 PDO 플레이스홀더 이름 악용을 통한 JSON:API 필터 배열 키 주입 개요 CVE-2026-9082 는 Drupal 코어 에서 Drupal 8.011.3.9 을 실행하는 모든 PostgreSQL 기반 사이트에 영향을 미치는 매우 치명적인Highly Critical SQL 인젝션 취약점입니다. 2026-05-22에 CISA 알려진 악용 취약점KEV...

CVE-2026-9082-Drupal-PoC

CVE-2026-9082 - Drupal Core PostgreSQL SQL Injection PoC Overview This repository provides an ethical Proof-of-Concept PoC for CVE-2026-9082 , a Highly Critical SQL injection vulnerability in Drupal Core affecting all PostgreSQL-backed sites running Drupal 8.0 through 11.3.9. The flaw resides in...

CVE-2026-52618

CVE-2026-52618 — @webfer/mcp-ansible-drupal: OS command injection via executeDeployment extra vars spawncmd0, cmd.slice1, shell: true re-joins an argument array into a single /bin/sh -c string without escaping, so a shell metacharacter in an extraVars value supplied to the executeDeployment MCP...