191 matches found
VulnHub-DC1-Writeup
VulnHub-DC1-Writeup "Penetration testing lab writeups documenting full attack chains — from recon to root." 🔓 VulnHub — DC-1 Boot-to-Root Writeup Difficulty: Beginner–Intermediate Platform: VulnHub Goal: Capture all 4 flags and achieve full root-level compromise Attacker OS: Kali Linux VirtualBox...
CVE-2018-7600-Drupalgeddon2-RCE
CVE-2018-7600 Drupalgeddon2 — Red Team Project ITSOLERA Cybersecurity Department | Offensive Security Internship 2026 Overview This project researches, replicates, and documents CVE-2018-7600 Drupalgeddon2 — a Critical CVSS 9.8 unauthenticated Remote Code Execution vulnerability in Drupal CMS,...
cve-2018-7600-drupalgeddon2-lab
CVE-2018-7600 Drupalgeddon2 Vulnerability Lab Educational lab demonstrating exploitation of CVE-2018-7600 Drupalgeddon2 using a vulnerable Drupal 7.56 environment deployed with Docker. This project simulates a real-world vulnerability assessment workflow, including: Vulnerable environment setup...
drupalgeddon2-cli
drupalgeddon2-cli A command-line rewrite of the Drupalgeddon2 CVE-2018-7600 proof-of-concept, built as a study exercise while working through the Hack The Box Academy Attacking Common Applications module. !WARNING For authorised security testing and education only. Running this against systems yo...
CVE-2018-7600
TRAN CONG DANH - SVTT - Mentor: LUU VAN LAN - CVE-2018-7600 - Day Started: 26/06/2024. Table of contents: 1. CVE summary 2. Prerequisites 3. CVE Analyse 4. Mitigation CVE summary An attacker could call a Drupal Form API Ajax Request containing the calluserfunc auto do function Drupal before 7.58,...
CVE-2022-25278
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules...
CVE-2022-25273
Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter...
cybersecurity-lab-reports
🛡️ Red Team & Cybersecurity Engineering Technical Reports Wel...
Drupal 8.5.0 Form API Remote Code Execution
Drupal version 8.5.0 contains a Form API render array injection vulnerability that allows unauthenticated remote code execution. This proof of concept supplies a vulnerable Docker environment and an HTTP request that demonstrates the issue. https://packetstorm.news/download/235020...
Exploit for Improper Input Validation in Drupal
Drupalgeddon 2 CVE-2018-7600 Vulhub's...
Drupal Drupalgeddon2 RCE (CVE-2018-7600)
Exploits CVE-2018-7600 in Drupal 7/8 via form API render array injection on /user/register mailpostrender=passthru for unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Drupalgeddon2 RCE CVE-2018-7600.""" import re from kittysploit import from lib.protocols.http.httpclient...
CLEANSTART-2024-SC89971 Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities
Security vulnerability affects the drupal7 package. Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which can lead to other vulnerabilities...
CLEANSTART-2024-CD40650 Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation
Security vulnerability affects the drupal7 package. Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation...
Exploit for Improper Input Validation in Drupal
SAWPOC — CVE-2018-7600 A Python Proof of Concept for CVE-20...
CVE-2026-15735
The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WS-2022-0117
Drupal core's form API prior to 9.2.18 and before 9.3.12 has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain...
MiracleLinux 3 : drupal-6.30-1.AXS3 (AXSA:2014-234:01)
The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-234:01 advisory. Drupal is a free software package that allows an individual or a community of users to easily publish, manage and organize a wide variety of content ...
EUVD-2015-6598
Malware in sbrugna...