Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-9082: PostgreSQL SQL Injection in Drupal

yeswehack.com | vulnerability | Critical | Actively exploited | CVE-2026-9082 | #active-exploitation | #sql-injection | #postgresql | #poc | #patch-analysis | #cve-2026-9082 | #drupal

Summary

A patch analysis of CVE-2026-9082 (SA-CORE-2026-004): a PostgreSQL-specific SQL injection in Drupal’s entity query subsystem where unsanitised array keys reach SQL, plus PoC paths and the fix.
CVSS
9.8
Published
Collected

original ↗

Related coverage

  1. CVE-2023-25157 PoC: GeoServer jsonArrayContains SQL injection to PostgreSQL RCE (gist.github.com)
  2. CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout (github.com)
  3. CVE-2026-48907: Unauthenticated RCE in the Joomla Content Editor extension (yeswehack.com)
  4. MyBB <= 1.8.31: Remote Code Execution Chain (swarm.ptsecurity.com)
  5. Cooking an SQL Injection Vulnerability in Chef Automate (xbow.com)
  6. CVE-2026-63077: JetBrains TeamCity unauthenticated RCE with public PoC and active exploitation (github.com)

back