CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-9082Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query | Drupal · Drupal core | Exploited | 9.8 | 89% | 2026-05-20 |
| CVE-2014-3704Drupal SQL Injection | Drupal · Drupal | Public check | – | 100% | 2014-10-16 |
| CVE-2008-3223SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placehold… | Drupal · Drupal | Possible | – | 3.2% | 2008-07-18 |
| CVE-2015-6659SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL… | Drupal · Drupal | Possible | – | 3.0% | 2015-08-24 |
| CVE-2009-1034SQL injection vulnerability in the Tasklist module 5.x-1.x before 5.x-1.3 and 5.x-2.x before 5.x-2.0-alpha1, a module for Drupal, allows remote attackers to execute arbitrary SQL… | Drupal · Tasklist | Possible | – | 1.8% | 2009-03-20 |
| CVE-2007-6299Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass… | Drupal · Drupal | Possible | – | 1.7% | 2007-12-10 |
| CVE-2008-6020SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an expo… | Drupal · Views | Possible | – | 1.4% | 2009-02-02 |
| CVE-2012-2306SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | Drupal · Drupal | Possible | – | 1.2% | 2012-07-25 |
| CVE-2008-4148SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via… | Drupal · Mailhandler | Possible | – | 1.1% | 2008-09-19 |
| CVE-2009-1505SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute ar… | Drupal · News Page | Possible | – | 1.1% | 2009-05-01 |
| CVE-2011-2715An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names. | Drupal · Data-module | Possible | – | 1.1% | 2020-01-14 |
| CVE-2008-6134SQL injection vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | Drupal · Everyblog | Possible | – | 1.1% | 2009-02-14 |
| CVE-2008-4531SQL injection vulnerability in Brilliant Gallery 5.x before 5.x-4.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, relate… | Drupal · Brilliant Gallery | Possible | – | 1.1% | 2008-10-09 |
| CVE-2008-2999Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors. | Drupal · Aggregation Module | Possible | – | 1.1% | 2008-07-03 |
| CVE-2008-2850SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified cookies, related to im… | Drupal · Trailscout Module | Possible | – | 1.1% | 2008-06-25 |
| CVE-2008-5998Multiple SQL injection vulnerabilities in the ajax_checklist_save function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "updat… | Drupal · Ajax Checklist | Unlikely | – | 1.0% | 2009-01-28 |
| CVE-2008-6276Multiple SQL injection vulnerabilities in the User Karma module 5.x before 5.x-1.13 and 6.x before 6.x-1.0-beta1, a module for Drupal, allow remote authenticated administrators to… | Drupal · User Karma Module | Unlikely | – | 0.9% | 2009-02-25 |
| CVE-2008-3092SQL injection vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to execute arb… | Drupal · Taxonomy Autotagger Module | Unlikely | – | 0.9% | 2008-07-09 |
| CVE-2008-6383SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated us… | Drupal · Storm | Unlikely | – | 0.8% | 2009-03-02 |
| CVE-2008-4633SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again" is enabled, allows remote authenticated us… | Drupal · Node Clone | Unlikely | – | 0.8% | 2008-10-21 |
| CVE-2026-87938CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136 | Drupal · CSP log | Unlikely | 6.5 | 0.4% | 2026-10-22 |
| CVE-2026-15081Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072 | Drupal · Location Selector | Unlikely | 7.4 | 0.3% | 2026-07-10 |
| CVE-2026-13242Geolocation Field - Critical - SQL Injection - SA-CONTRIB-2026-062 | Drupal · Geolocation Field | Unlikely | 6.5 | 0.3% | 2026-07-10 |
| CVE-2026-87936amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134 | Drupal · amazee.ai Private AI Provider | Unlikely | 6.5 | 0.3% | 2026-10-22 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-15.