Description
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Drupal core | Drupal / Drupal core | >= 10.5.0, < 10.5.10 | affected |
| Drupal core | Drupal / Drupal core | >= 10.6.0, < 10.6.9 | affected |
| Drupal core | Drupal / Drupal core | >= 11.0.0, < 11.1.10 | affected |
| Drupal core | Drupal / Drupal core | >= 11.2.0, < 11.2.12 | affected |
| Drupal core | Drupal / Drupal core | >= 11.3.0, < 11.3.10 | affected |
| Drupal core | Drupal / Drupal core | >= 8.9.0, < 10.4.10 | affected |