Drupal Field UI Code Execution

The vulnerability of the Field UI web interface in the Drupal CMS system’s kernel is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Exploit for CVE-2026-108097

CVE-2026-108097 Full-Chain Exploiter Python3 Tool Python3 y...

Vulnerabilities present in Drupal Core and modules due to Drupal

Drupal has vulnerabilities in the Drupal Core Field UI module, Entity List module, Navigation module, Link module, and the Gin administration theme. These vulnerabilities affect multiple modules within Drupal. The Field UI module and the Entity List module contain a remote code execution...

Drupal Core 11.4.9 Field UI Remote Code Execution

Drupal Core version 11.4.9 Field UI contains a remote code execution vulnerability when contributed or custom code permits HTTP control of a table row's region callback. This research pack provides a loopback Docker proof of concept with a synthetic writer and documents an upload-staged execution...

FreeBSD : Drupal 10 and 11 -- remote code execution (3de00266-caf6-11f1-881f-d89ef317b2fc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3de00266-caf6-11f1-881f-d89ef317b2fc advisory. Drupal core reports: A remote code execution vulnerability exists within the Field UI module in Drupal...

Exploit for CVE-2026-108097

CVE-2026-108097: Drupal Field UI callback flaw lab research p...

Drupal Core 12.0.0-beta1 Field UI Remote Code Execution Detection Tool

Drupal Core versions containing the Field UI module are vulnerable to remote code execution. This tool performs read-only version and Field UI checks to identify potentially affected installations...

Exploit for CVE-2026-108097

CVE-2026-108097 — Drupal Core Field UI RCE Detection Tool Def...

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drupal 11.4.10, 11.3.19, and 10.6.19. An attacker cannot reach the flaw through core alone, the Drupal Security Team said in its advisory. Sever...

CVE-2026-108097

A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code ma...

DRUPAL-CORE-2026-014

A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code ma...

Drupal 10 and 11 -- remote code execution

Drupal core reports: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require...

Drupal core - Critical - Remote code execution - SA-CORE-2026-014

A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require authentication. Custom code ma...

Drupal 10.6.x < 10.6.19 / 11.3.x < 11.3.19 / 11.4.x < 11.4.10 Multiple Vulnerabilities (drupal-2026-10-14)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to 10.6.19, 11.3.x prior to 11.3.19, or 11.4.x prior to 11.4.10. It is, therefore, affected by multiple vulnerabilities. - The Drupal core Link module provides a field type that can be...

PT-2026-114006

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 10.6.19 Drupal versions prior to 11.3.19 Drupal versions prior to 11.4.10 Description A remote code execution issue exists within the Field UI module field ui in Drupal core. While the issue is not directly exploitable...

PT-2026-121196

Уязвимость веб-интерфейса Field UI field ui ядра CMS-системы Drupal связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

EUVD-2015-3288

Malware in sbrugna...

CVE-2024-33859

An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS...

Mageia: Security Advisory (MGASA-2015-0253)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated drupal package fixes security vulnerability

Incorrect cache handling made private content viewed by "user 1" exposed to other, non-privileged users CVE-2015-3231. A flaw in the Field UI module made it possible for attackers to redirect users to malicious sites CVE-2015-3232. Due to insufficient URL validation, the Overlay module could be...