Skip to content
OpenAdvisories
High WID-SEC-2026-1998 3 CVEs

Drupal Module: Mehrere Schwachstellen ermöglichen Manipulation von Daten

Published Jun 17, 2026 · Updated Jul 12, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um Daten zu manipulieren.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 3

  • Critical 9.8
    CVE-2026-12535

    Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Formatter Field allows Object Injection. This issue affects Formatter Field versions: from 0.0.0 to 2.0.0.

    Drupal Formatter Field drupal/formatter_field Packagist
  • High 8.1
    CVE-2026-55809

    Flag attendance field - Critical - PHP object injection - SA-CONTRIB-2026-049

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Flag attendance field allows Object Injection. This issue affects Flag attendance field versions: from 0.0.0 to 1.2.

    Drupal Flag attendance field drupal/flag_attendance_field Packagist
  • High 8.1
    CVE-2026-55810

    Plotly.js Graphing - Critical - PHP object injection - SA-CONTRIB-2026-050

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Plotly.js Graphing allows Object Injection. This issue affects Plotly.js Graphing versions: from 0.0.0 to 3.0.2.

    Drupal Plotly.js Graphing drupal/plotly_js Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-43054, EUVD-2026-43053, EUVD-2026-43051

  2. #1

    Initiale Fassung

References