ID:12978 - Exploit for SQL injection in Drupal - CVE-2026-9082

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary SQL queries.

The vulnerability exists due to improper input validation in the database abstraction API when handling specially crafted requests. A remote attacker can send a specially crafted request to perform arbitrary SQL injection.

Only sites using PostgreSQL databases are vulnerable. Anonymous exploitation is possible. Successful exploitation can lead to information disclosure and, in some cases, privilege escalation or remote code execution.

Remediation