Cross site scripting

Cross-site scripting XSS vulnerability in the Modal Frame API module 6.x-1.x before 6.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8296

Cross-site scripting XSS vulnerability in the Modal Frame API module 6.x-1.x before 6.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-8296

The CVE-2014-8296 entry concerns Drupal’s Modal Frame API module (version 6.x-1.x) with an XSS vulnerability in versions prior to 6.x-1.9. The issue is caused by insufficient filtering of user-supplied text, allowing remote attackers to inject arbitrary script or HTML via unspecified vectors. Aff...

CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

Sql injection

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

UBUNTU-CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

Drupal 7.0 7.31 - Drupalgeddon SQL Injection (PoC) (Reset Password) (1)

Drupal 7.0 7.31 - Drupalgeddon SQL Injection PoC Reset Password 1 Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Creditz to https://www.reddit.com/user/fyukyuk EDB Note Updated version:...

drupal: pre-auth sql injection

Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks. A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the...

Drupal 7.X SQL Injection

!/usr/bin/python Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Inspired by yukyuk's P.o.C https://www.reddit.com/user/fyukyuk Tested on Drupal 7.31 with BackBox 3.x This material is intended for educational purposes only and the author can not be held liable fo...

PT-2014-5461 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions prior to 7.32 Description: The issue concerns the expandArguments function in the database abstraction API, which does not properly construct prepared statements. This allows remote attackers to conduct SQL injection...

CVE-2014-3704

CVE-2014-3704 affects Drupal core 7.x; the expandArguments function in the database abstraction API does not properly construct prepared statements, enabling remote SQL injection via an array with crafted keys. Affected are Drupal core 7.x prior to 7.32 (pre-auth vulnerability). Potential impact ...

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (PoC) (Reset Password) (1)

Drupal 7.x SQL Injection SA-CORE-2014-005 https://www.drupal.org/SA-CORE-2014-005 Creditz to https://www.reddit.com/user/fyukyuk EDB Note Updated version: https://github.com/kenorb/drupageddon/blob/master/drupal7.xsqlinjectionsa-core-2014-005.py import urllib2,sys from drupalpass import DrupalHas...

Drupal 7.x < 7.32 SQLi

The remote web server is running a version of Drupal that is 7.x prior to 7.32. It is, therefore, potentially affected by a SQL injection vulnerability due to a flaw in the Drupal database abstraction API, which allows a remote attacker to use specially crafted requests that can result in arbitra...

Drupal 7.31 version of the explosion a serious SQL injection vulnerability-vulnerability warning-the black bar safety net

This morning a foreign security researchers on Twitter exposed a Drupal 7.31 version of the latestSQL injectionvulnerabilities and gives using a test of the EXP code, small local structures Drupal7. 3 1 environment, tested, found that the use of the code can be successfully executed and the...

Drupal Database Abstraction API SQLi

The remote web server is running a version of Drupal that is affected by a SQL injection vulnerability due to a flaw in the Drupal database abstraction API, which allows a remote attacker to use specially crafted requests that can result in arbitrary SQL execution. This may lead to privilege...

CVE-2014-3704

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys...

CVE-2014-3704

Removed by vendor...

Immunity Canvas: DRUPAL_NAME_SQLI

Name| drupalnamesqli ---|--- CVE| CVE-2014-3704 Exploit Pack| CANVAS Description| Drupal injection exploit Notes| CVE Name: CVE-2014-3704 VENDOR: drupal.org Notes: This exploit replaces the password of 'Drupal User' with 'Drupal Password'. If uid is specified, 'Drupal User' is ignored...

Immunity Canvas: DRUPAL_NAME_SQLI_CALLBACK

Name| drupalnamesqlicallback ---|--- CVE| CVE-2014-3704 Exploit Pack| CANVAS Description| Drupal injection exploit Notes| CVE Name: CVE-2014-3704 VENDOR: drupal.org Notes: This exploit tries to open a php callback to canvas by injecting php code in Drupal's login block through the database sql...