Drupal Core Remote Code Execution Vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-6340 · ADVISORY
• FriendsOfPHP/security-advisories · WEB
• FriendsOfPHP/security-advisories · WEB
• drupal/drupal · PACKAGE
• cisa.gov/known-exploited-vulnerabilities-catalog · WEB
• drupal.org/sa-core-2019-003 · WEB
• exploit-db.com/exploits/46452 · WEB
• exploit-db.com/exploits/46459 · WEB
• exploit-db.com/exploits/46510 · WEB
• synology.com/security/advisory/Synology_SA_19_09 · WEB
• securityfocus.com/bid/107106 · Broken Link
• exploit-db.com/exploits/46452 · Patch
• exploit-db.com/exploits/46459 · Exploit
• exploit-db.com/exploits/46510 · Exploit
• CISA KEV · CVE-2019-6340

drupal/core のその他の脆弱性

• CVE-2026-108514The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.
• CVE-2026-108515The Drupal core Link module provides a field type that can be used for internal and external URLs.
• CVE-2026-108097A remote code execution vulnerability exists within the Field UI module in Drupal core.
• DRUPAL-CORE-2026-013The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor5) library for WYSIWYG editing. CKEditor has released [a security…
• CVE-2026-55805中 5.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. …