PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-9082: PostgreSQL SQL Injection in Drupal

yeswehack.com | vulnerability | Critical | Actively exploited | CVE-2026-9082 | #active-exploitation | #sql-injection | #postgresql | #poc | #patch-analysis | #cve-2026-9082 | #drupal
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A patch analysis of CVE-2026-9082 (SA-CORE-2026-004): a PostgreSQL-specific SQL injection in Drupal’s entity query subsystem where unsanitised array keys reach SQL, plus PoC paths and the fix.
CVE
CVE-2026-9082
CVSS
9.8
Published
Collected

Related coverage

vulnerability · netspi.com
CVE-2026-9082 Drupal Core PostgreSQL SQL Injection Overview and Takeaways
CVE-2026-9082 (CVSS 9.8) lets unauthenticated attackers run arbitrary SQL against Drupal Core on PostgreSQL via crafted JSON:API queries, risking database compromise or RCE; upgrade immediately.
vulnerability · slcyber.io
Keys to the Kingdom: Anonymous SQL Injection in Drupal Core (CVE-2026-9082)
Assetnote discovers an anonymous SQL injection vulnerability in Drupal Core exposing the full database without authentication — CVE-2026-9082.
Critical · vulnerability · yeswehack.com
CVE-2026-48907: Unauthenticated RCE in the Joomla Content Editor extension
YesWeHack's analysis of CVE-2026-48907, a CVSS 10.0 unauthenticated RCE in the Joomla Content Editor: profile import abuse drops a PHP webshell; fixed in 2.9.99.5 with hardening in 2.9.99.6.
Critical · vulnerability · github.com
GitLab CE/EE Unauthenticated Arbitrary File Read Exploit PoC (CVE-2026-85706)
GitLab is widely deployed across enterprise infrastructure; a CVSS 10.0 unauthenticated file read listed in CISA KEV enables attackers to leak gitlab-secrets.json and database credentials, easily leading to full instance takeover.
Critical · vulnerability · github.com
MicroTrick: MikroTik RouterOS Unauthenticated Takeover Exploit PoC (CVE-2026-86060)
MikroTik routers form critical edge infrastructure worldwide; with confirmed active exploitation in the wild and public PoC code available, unpatched edge devices face immediate risk of remote takeover.
tool · github.com
PoC for CVE-2026-67401: cPanel/WHM EmailTrack SQL Injection Leading to Root RCE
cPanel is widely used in shared web hosting environments. This vulnerability allows low-privileged tenants with mail permissions to achieve full host takeover as root. Administrators should urgently patch cPanel to the latest builds across all supported series.
Back