Skip to content
OpenAdvisories
High WID-SEC-2026-3968 5 CVEs

Drupal Core, Gin Admin Theme und Entity List: Mehrere Schwachstellen

Published Oct 14, 2026 · Updated Oct 29, 2026 · Revision 3 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Drupal ausnutzen, um beliebigen Programmcode auszuführen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Drupal ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 5

  • High 8.1
    CVE-2026-108097 Public exploit

    Drupal core - Critical - Remote code execution - SA-CORE-2026-014

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core allows Reflection Injection. This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to 11.4.10,…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • High 8.1
    CVE-2026-108099

    Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List allows Reflection Injection. This issue affects Entity List versions: from 0.0.0 to 3.0.10.

    Drupal Entity List drupal/entity_list Packagist
  • Medium 6.5
    CVE-2026-108514

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-016

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 10.3.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to…

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-108515

    Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 8.9.0 to 10.6.19, from 11.0.0 to 11.3.19, from 11.4.0 to …

    Drupal Drupal core drupal/core Web / CMS Packagist
  • Medium 6.5
    CVE-2026-110738

    Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219

    Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin Theme allows Cross-Site Scripting (XSS). This issue affects Gin Admin Theme versions: from 0.0.0 to 4.1.4, from 5.0.0 to 5.0.16.

    Drupal Gin Admin Theme drupal/gin Packagist

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-113557, EUVD-2026-113556, EUVD-2026-113555, EUVD-2026-113553, EUVD-2026-113554

  2. #2

    PoC aufgenommen

  3. #1

    Initiale Fassung

References