drupalgeddon2

Drupalgeddon 2 Drupalgeddon 2 CVE-2018-7600 / SA-CORE-2018-002용 MSF 익스플로잇 모듈 Drupal 7.58 이전, 8.x 8.3.9 이전, 8.4.x 8.4.6 이전, 8.5.x 8.5.1 이전 버전은 기본 또는 일반적인 모듈 구성으로 여러 하위 시스템에 영향을 미치는 문제로 인해 원격 공격자가 임의 코드를 실행할 수 있도록 합니다. 이 모듈은 php/base64 인코더를 사용하여 msf PHP 아키텍처 페이로드를 로드할 수 있습니다. Drupal에서의 결과적인 RCE는 다음...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 灵感来自 https://github.com/dreadlocked/Drupalgeddon2 支持： Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL，攻击 account/mail 和 postrender 参数，使用 PHP 的 passthru 函数 待定 尚未编写 Drupal 7.58 user/password URL，攻击...

CVE-2020-13671

CVE-2020-13671 ファイルアップロードによるRCE — Drupalコア ソフトウェア: Drupal Core 8.7.5 影響を受けるバージョン: 7.x 7.78、8.x 8.8.11、8.9.x 8.9.9、9.0.x 9.0.8 CVSS: 8.8 高 CWE: CWE-434 — 危険なタイプのファイルの無制限アップロード CISA KEV: 対象 — 既知の悪用済み脆弱性 Advisory: SA-CORE-2020-012 Drupalとは...

CMSScan

CMSScan WordPress, Drupal, Joomla, vBulletin 웹사이트의 보안 문제를 스캔합니다. Made with in 인도 CMSScan은 CMS 보안 스캔을 위한 중앙 집중식 보안 대시보드를 제공합니다. wpscan, droopescan, vbscan 및 joomscan을 기반으로 구동됩니다. 온디맨드 스캔과 예약 스캔을 모두 지원하며 이메일 보고서를 보낼 수 있습니다. 설치 root@kitploit: Requires ruby, ruby-dev, gem, libwww-perl, python3.6+ and...

drupal-exploit

drupal-exploit CVE-2018-7600 이 스크립트는 Drupal 7 : drupal.py https://drupaldomain/drupal/ uid=33www-data gid=33www-data groups=33www-data https://nvd.nist.gov/vuln/detail/CVE-2018-7600 https://www.drupal.org/sa-core-2018-002...

CVE-2020-13671-old

CVE-2020-13671 ファイルアップロードによるRCE — Drupal Core ソフトウェア: Drupal Core 8.7.5 影響を受けるバージョン: 7.x 7.78, 8.x 8.8.11, 8.9.x 8.9.9, 9.0.x 9.0.8 CVSS: 8.8 高 CWE: CWE-434 — 危険なタイプのファイルの無制限アップロード CISA KEV: はい — 既知の悪用済み脆弱性 アドバイザリ: SA-CORE-2020-012 Drupalとは...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

CVE-2018-7600

CVE-2018-7600 root@kitploit: PoC for CVE-2018-7600 Drupal SA-CORE-2018-002 Drupalgeddon 2. Installation: $ git clone https://github.com/dwisiswant0/CVE-2018-7600 $ cd CVE-2018-7600/ $ composer install Usage: $ php exploit.php WARNING! For Educational Purposes Only! References: -...

Drupal 11.x-dev - Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. id: CVE-2024-45440 info: name: Drupal 11.x-dev - Full Path Disclosure author: DhiyaneshDK severity: medium description: |...

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion

In avataruploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. id: CVE-2018-9205 info: name: Drupal avataruploader v7.x-1.0-beta8 - Local File Inclusion author: daffainfo severity: high description: In avataruploader...

Drupal 7 CKEditor XSS

CKEditor 4.14.0 through 4.16.x before 4.16.1 contains a reflected cross-site scripting caused by mishandling in comments, letting remote attackers inject executable JavaScript code, exploit requires victim to view malicious content. id: CVE-2021-33829 info: name: Drupal 7 CKEditor XSS author:...

Drupal - Remote Code Execution

Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases. id: CVE-2019-6340 info: name: Drupal - Remote Code Execution author: madrobot severity:...

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

drupal8-REST-RCE

drupal8-REST-RCE CVE-2019-6340 drupal8-REST-RCE /node/1 , CVE-2018-7600 drupal8 RCE /user/register Unix/Linux コマンド - リモートコード実行 コマンド "id" 使用方法 root@kitploit: python drupal8-REST-RCE.py user defined port python drupal8-REST-RCE.py default : 80/tcp 更新! python3 をサポートするようにスクリプトを編集しました 2020.11.07...

droopescan

droopescan 플러그인 기반 스캐너로, 보안 연구자가 여러 CMS의 문제를 식별하는 데 도움을 줍니다. droopescan을 사전 상호 동의 없이 대상을 공격하는 데 사용하는 것은 불법입니다. 최종 사용자는 모든 해당 지역, 주 및 연방 법률을 준수할 책임이 있습니다. 개발자는 어떠한 책임도 지지 않으며, 이 프로그램으로 인한 오용이나 손해에 대해 책임을 지지 않습니다. droopescan이 원격 호스트에 설치된 가장 가능성 있는 CMS 버전을 출력하지만, 버전 번호와 취약점 간의 연관성은 사용자가 수동으로 수행해야 합니...

CVE-2018-7600

CVE-2018-7600 - Drupal 7 リモートコード実行 これは、脆弱なDrupal 7インストール（= 7.57）を標的としたCVE-2018-7600エクスプロイトのRust実装です。このCLIは次のPoCフローを再現します。user/passwordパスを介してキャッシュされたレンダリング可能なフォームを汚染し、formbuildidを抽出し、その後file/ajaxエンドポイントを通じてキャッシュされたペイロードをトリガーし、PHP関数呼び出しによるリモートコード実行を達成します。 脆弱性の概要 CVE-2018-7600は、Drupal...

base-drupal

BASE-DRUPAL 这是 Cved 的一部分： 一个用于管理易受攻击的 docker 容器的工具。 Cved：https://github.com/git-rep-src/cved 镜像来源：https://github.com/cved-sources/base-drupal 镜像基于：https://github.com/Medicean/VulApps/tree/master/base/drupal/8.3.0...

cve-2019-6340-bits

cve-2019-6340-bits CVE-2019-6340 Drupal RESTful RCEの分析中に生成されたビット modsecルール pcap nginx設定例 ログ例 プレイブック例...

CVE-2018-7600-Drupal-RCE

CVE-2018-7600-Drupal-RCE...

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — 応答URLの未検証取得による SSRF／ローカルファイル読み取り（CVE-2026-13233） Untrusted upstream：プロバイダーが、応答に入っていたURLをそのまま開いた話。 Drupal OpenAI Provider （aiprovideropenai）・SSRF （CWE-918）・CVE-2026-13233 ・SA-CONTRIB-2026-053 状態 ：協調的開示は 完了（2026-07-10） 。Drupal Security Team へ非公開で報告 → 修正 → CVE-2026-13233 ／...