14238 matches found
DRUPAL-CONTRIB-2026-038
The Basket module enables e-commerce and checkout functionality for Drupal sites. The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize. An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the...
Exploit for SQL Injection in Drupal
python3 c...
Exploit for SQL Injection in Drupal
CVE-2026-9082 Passive checker for CVE-2026-9082 / SA-CORE-2...
Exploit for Deserialization of Untrusted Data in Drupal
CVE-2019-6340 — Drupal RESTful Web Services RCE Python imple...
PT-2026-44164
Name of the Vulnerable Software and Affected Versions Basket versions prior to 2.1.17 Description The Basket module, which provides e-commerce and checkout functionality for Drupal sites, fails to sufficiently sanitize user-supplied data before it is processed by the PHP unserialize function. Thi...
Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038
The Basket module enables e-commerce and checkout functionality for Drupal sites. The module does not sufficiently sanitize user-supplied data before passing it to PHP's unserialize. An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the...
patch-to-exploit
patch-to-exploit Lab + PoC scripts for "30 minutes from patch...
CVE-2026-9082
A flaw was found in Drupal core. This vulnerability, identified as an SQL Injection CWE-89, allows a remote attacker to execute malicious SQL commands. By exploiting this, an attacker could potentially access, modify, or delete sensitive data within the database, leading to information disclosure...
CVE-2026-4093
A flaw was found in the Drupal 7 Term Reference Tree module. This vulnerability, a type of stored Cross-Site Scripting XSS, allows an authenticated attacker with permissions to edit or create taxonomy terms to inject malicious scripts. These scripts can execute when a user views a form containing...
PT-2026-43390
Name of the Vulnerable Software and Affected Versions ConeXware, Inc Power Archiver versions prior to 22.00.12 Drupal affected versions not specified Description An issue in the powerarc.exe executable allows a remote attacker to escalate privileges and execute arbitrary code. Separately, a SQL...
Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2026-9082 CVSS score: 6.5, an...
GHSA-7P85-W9PX-JPJP vulnerabilities
Vulnerabilities for packages: drupal...
GHSA-7FXW-R6JV-74C8 vulnerabilities
Vulnerabilities for packages: drupal...
GHSA-45VW-WH46-2VX8 vulnerabilities
Vulnerabilities for packages: drupal...
GHSA-24X9-R6Q4-Q93W vulnerabilities
Vulnerabilities for packages: drupal...
CVE-2026-46635 vulnerabilities
Vulnerabilities for packages: drupal...
CVE-2026-46634 vulnerabilities
Vulnerabilities for packages: drupal...
CVE-2026-46633 vulnerabilities
Vulnerabilities for packages: drupal...