Skip to content
OpenAdvisories
Critical 1 exploited CVE WID-SEC-2026-2002 6 CVEs

Drupal Core: Mehrere Schwachstellen

Published Jun 17, 2026 · Updated Jul 12, 2026 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal Core ausnutzen, um beliebigen Programmcode auszuführen, Cross-Site-Scripting-Angriffe durchzuführen, um Daten zu manipulieren, oder um Nutzer auf bösartige Websites umzuleiten.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 6

  • High 8.1
    CVE-2019-6340 Exploited Public exploit Scanner template EPSS 92%

    Drupal core - Highly critical - Remote Code Execution

    Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions …

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Packagist
    KEV Mar 25, 2022
  • Medium 5.9
    CVE-2026-55803

    Drupal core - Critical - PHP object injection - SA-CORE-2026-005

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55804

    Drupal core - Moderately critical - Gadget chain - SA-CORE-2026-006

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.9
    CVE-2026-55806

    Drupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows Content Spoofing. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 5.4
    CVE-2026-55808

    Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Low 3.1
    CVE-2026-55807

    Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008

    Server-Side Request Forgery (SSRF) vulnerability in Drupal Drupal core allows Server Side Request Forgery. This issue affects Drupal core versions: from 0.0.0 to 10.5.12, from 10.6.0 to 10.6.11, from 11.2.0 to 11.2.14, from 11.3.0 to 11.3.12, from 0.0.0 to 11…

    Drupal Drupal core drupal/core Web / CMS Packagist

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-43085, EUVD-2026-43084, EUVD-2026-43082, EUVD-2026-43083, EUVD-2026-43081

  2. #2

    CVE's ergänzt

  3. #1

    Initiale Fassung

References