Lucene search
+L

14689 matches found

Nuclei
Nuclei
added 2026/09/22 2:05 a.m.115 views

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion

In avataruploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. id: CVE-2018-9205 info: name: Drupal avataruploader v7.x-1.0-beta8 - Local File Inclusion author: daffainfo severity: high description: In avataruploader...

7.5CVSS7.3AI score0.29651EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.48 views

Drupal 7 CKEditor XSS

CKEditor 4.14.0 through 4.16.x before 4.16.1 contains a reflected cross-site scripting caused by mishandling in comments, letting remote attackers inject executable JavaScript code, exploit requires victim to view malicious content. id: CVE-2021-33829 info: name: Drupal 7 CKEditor XSS author:...

6.1CVSS6.8AI score0.03189EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.63 views

Drupal - Remote Code Execution

Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases. id: CVE-2019-6340 info: name: Drupal - Remote Code Execution author: madrobot severity:...

8.1CVSS8.2AI score0.92017EPSS
SaveExploits23References5
Nuclei
Nuclei
added 2026/09/22 2:05 a.m.34 views

Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query

Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL...

9.8CVSS7.8AI score0.89986EPSS
SaveExploits17References2
Kitploit
Kitploit
added 2026/09/22 1:35 a.m.9 views

drupal8-REST-RCE

drupal8-REST-RCE CVE-2019-6340 drupal8-REST-RCE /node/1 , CVE-2018-7600 drupal8 RCE /user/register Unix/Linux 命令 - 远程代码执行(命令 "id") 用法 root@kitploit: python drupal8-REST-RCE.py user defined port python drupal8-REST-RCE.py default : 80/tcp 已更新! 脚本已修改以支持 python3 2020.11.07 仅用于对您的系统进行漏洞测试...

9.8CVSS8.5AI score0.99991EPSS
SaveExploits71
Kitploit
Kitploit
added 2026/09/21 7:41 p.m.10 views

cve-2019-6340-bits

cve-2019-6340-bits 分析 CVE-2019-6340 Drupal RESTful RCE 时生成的资料 modsec 规则 pcap 示例 nginx 配置 示例日志 示例 playbook...

8.1CVSS8.1AI score0.92017EPSS
SaveExploits23References5
Kitploit
Kitploit
added 2026/09/21 7:40 p.m.7 views

CVE-2018-7600-Drupal-RCE

CVE-2018-7600-Drupal-RCE...

9.8CVSS8AI score0.99991EPSS
SaveExploits49
Kitploit
Kitploit
added 2026/09/21 7:05 p.m.11 views

drupal-openai-provider-ssrf-cve-2026-13233

Drupal OpenAI Provider — 通过响应 URL 进行的 SSRF / 本地文件读取(CVE-2026-13233) 不可信的上游:该提供者获取了其响应所指示的 URL。 Drupal OpenAI Provider (aiprovideropenai)· SSRF (CWE-918)· CVE-2026-13233 · SA-CONTRIB-2026-053 状态: 协调披露 已完成(2026-07-10)。 已私下报告给 Drupal 安全团队,已修复,并以 CVE-2026-13233 / 公告 SA-CONTRIB-2026-053 发布(评级为 中度严重...

3.3CVSS5.9AI score0.00208EPSS
SaveExploits1References7
Kitploit
Kitploit
added 2026/09/21 6:51 p.m.12 views

drupal-jsonapi-sqli-scanner

CVE-2026-9082 — Drupal PostgreSQL SQL 注入 批量扫描与利用工具 Drupal 核心(PostgreSQL)未认证 SQL 注入 通过滥用 PDO 占位符名称实现 JSON:API 过滤器数组键注入 概述 CVE-2026-9082 是 Drupal 核心 中的一个极度严重 SQL 注入漏洞,影响所有使用 PostgreSQL 后端 并运行 Drupal 8.0 至 11.3.9 的站点。该漏洞已于 2026-05-22 被列入 CISA 已知被利用漏洞(KEV)目录 ——正在野外被积极利用。 影响...

9.8CVSS7.4AI score0.89986EPSS
SaveExploits17
Kitploit
Kitploit
added 2026/09/21 6:03 p.m.10 views

CVE-2026-9082-Drupal-PoC

CVE-2026-9082 - Drupal Core PostgreSQL SQL Injection PoC Overview This repository provides an ethical Proof-of-Concept PoC for CVE-2026-9082 , a Highly Critical SQL injection vulnerability in Drupal Core affecting all PostgreSQL-backed sites running Drupal 8.0 through 11.3.9. The flaw resides in...

9.8CVSS7.7AI score0.89986EPSS
SaveExploits17
Kitploit
Kitploit
added 2026/09/21 5:21 p.m.9 views

CVE-2026-52618

CVE-2026-52618 — @webfer/mcp-ansible-drupal: OS command injection via executeDeployment extra vars spawncmd0, cmd.slice1, shell: true re-joins an argument array into a single /bin/sh -c string without escaping, so a shell metacharacter in an extraVars value supplied to the executeDeployment MCP...

5.9AI score
SaveExploits3References6
Kitploit
Kitploit
added 2026/09/21 4:07 p.m.12 views

https-nj.gov---CVE-2019-11358

https-nj.gov---CVE-2019-11358 新泽西州官方网站漏洞报告 jQuery 3.4.0 之前的版本(如 Drupal、Backdrop CMS 及其他产品中使用)由于 Object.prototype 污染,错误处理了 jQuery.extendtrue, , ...。如果未清理的源对象包含可枚举的 proto 属性,则可能扩展原生的 Object.prototype。 建议 src/core.js...

6.1CVSS6.8AI score0.87218EPSS
SaveExploits4References4
Kitploit
Kitploit
added 2026/09/21 4:00 p.m.8 views

CVE-2019-6340

CVE-2019-6340 CVE-2019-6340 POC Drupal RCE python poc.py url php func command node number 示例: python poc.py http://192.168.142.148/drupal-8.6.9/ system ipconfig 200 Twitter: @0w4ys...

8.1CVSS8.1AI score0.92017EPSS
SaveExploits23
Kitploit
Kitploit
added 2026/09/21 3:21 p.m.7 views

Drupalgedon3

POC for Drupal exploit SA-CORE-2018-004 / CVE-2018-7602 Author Alexandre Nguyen Usage root@kitploit: usage: exploit.py -h --command --nodeid --url POC for Drupal vulnerability SA-CORE-2018-004 arguments: -h, --help show this help message and exit --command Command to inject --nodeid Node to targe...

9.8CVSS7.6AI score0.99236EPSS
SaveExploits14
Kitploit
Kitploit
added 2026/09/21 2:14 p.m.10 views

CVE-2018-7600

Drupal-CVE-2018-7600 Usage: root@kitploit: python3 exploitdrupalcve-2018-7600.py...

9.8CVSS8.3AI score0.99991EPSS
SaveExploits49
Kitploit
Kitploit
added 2026/09/21 11:15 a.m.13 views

CVE-2026-9082-Mass_Scanner

CVE-2026-9082-MassScanner 用于 Drupal Exploit CVE-2026-9082 的 Mass Scanner 要设置 ExploitPOC 脚本,请执行以下命令: root@kitploit: pip install requirements.txt 要使用 ExploitPOC 脚本,请执行以下命令: root@kitploit: python exploitpoc.py -t targets.txt -o results.txt -p 16 这是一个针对 Drupal CMS 最新漏洞 CVE-2026-9082 的 Mass Scanner。Ma...

9.8CVSS7.8AI score0.89986EPSS
SaveExploits17
Kitploit
Kitploit
added 2026/09/21 9:39 a.m.6 views

CVE-2018-7600

CVE-2018-7600 Drupalgeddon2 漏洞利用程序 – Python3 免责声明: 本项目仅供教育和授权渗透测试使用 。 请勿 在未获得明确书面授权的系统上使用此代码。 未经授权使用是非法 的,并可能受到法律惩罚。 作者不对任何滥用此工具的行为承担任何责任。 描述 该Python3脚本利用了CVE-2018-7600 Drupalgeddon2漏洞——一个影响多个Drupal版本的严重...

9.8CVSS8.5AI score0.99991EPSS
SaveExploits49
Kitploit
Kitploit
added 2026/09/21 4:45 a.m.9 views

CVE-2026-9082

🚨 CVE-2026-9082 : SQL Injection Vulnerability in Drupal Core High-Impact SQL Injection Vulnerability in Drupal Core PostgreSQL 📋 Overview CVE-2026-9082 is a SQL Injection vulnerability in Drupal Core’s database abstraction layer. It affects only sites using PostgreSQL as the database backend. The...

9.8CVSS7.9AI score0.89986EPSS
SaveExploits17
Kitploit
Kitploit
added 2026/09/21 4:05 a.m.10 views

CVE-2018-7600

TRAN CONG DANH - SVTT - 导师:LUU VAN LAN - CVE-2018-7600 - 开始日期:26/06/2024. 目录: 1. CVE 摘要 2. 先决条件 3. CVE 分析 4. 缓解措施 CVE 摘要 攻击者可以调用包含 calluserfunc 这个自动执行函数的 Drupal Form API Ajax 请求 受影响的 Drupal 版本:7.58 之前,8.x 在 8.3.9 之前,8.4.x 在 8.4.6 之前,8.5.x 在 8.5.1 之前 先决条件 在本实验环境中,我使用: Ubuntu 20.04 PHP 7.2, MariaDB...

9.8CVSS7.9AI score0.99991EPSS
SaveExploits49
Kitploit
Kitploit
added 2026/09/20 11:29 p.m.16 views

CVE-2026-9082

CVE-2026-9082 / Drupal SA-CORE-2026-004 概念验证 免责声明:本概念验证仅用于教育和研究目的。请勿在未经授权或许可的系统上使用此软件。作者对因滥用或使用本项目造成的任何损害不承担任何责任。 概述 针对 CVE-2026-9082 Drupal SA-CORE-2026-004 的概念验证(poc.py),这是一项 Drupal 核心中的严重 SQL 注入漏洞,当 Drupal 配置使用 PostgreSQL 数据库后端时,可能允许攻击者提交任意 SQL 查询。 该漏洞源于 Drupal 核心的 PostgreSQL...

9.8CVSS7.6AI score0.89986EPSS
SaveExploits17
Rows per page
Query Builder