EUVD-2026-43066
GHSA-hccw-5cx2-v346
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable with no auth per Drupal's public-facing views pattern; limited C:L/I:L reflects bounded SQL injection impact without full DB control.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.
AnalysisAI
SQL injection in the Drupal Geolocation Field contributed module exposes sites to unauthenticated database read and partial write access across all module versions prior to 3.15.0. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction, making it remotely triggerable against any publicly reachable Drupal installation running the affected module. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Drupal Geolocation Field contributed module must be installed and enabled on the target Drupal site, running any version from 0.0.0 up to but not including 3.15.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score reflects a meaningful but bounded risk profile: network-reachable (AV:N), low complexity (AC:L), no authentication required (PR:N), no user interaction needed (UI:N), but limited to partial confidentiality and integrity impact (C:L/I:L) with no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker discovers a Drupal site running the Geolocation Field module by identifying characteristic Drupal paths or module-specific URL patterns. The attacker submits a crafted HTTP request with SQL injection payloads embedded in a geolocation-related query parameter, which is incorporated unsanitized into a database query. … |
| Remediation | Upgrade the Geolocation Field module to version 3.15.0 or later, which contains the vendor-released patch as confirmed by the Drupal security advisory at https://www.drupal.org/sa-contrib-2026-062. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today