What is the CVSS score of CVE-2026-15081?

CVE-2026-15081 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Location Selector are affected by CVE-2026-15081?

The Drupal Location Selector contributed module (versions 0.0.0-1.3.0) contains a high-severity SQL injection vulnerability (CVE-2026-15081) that permits attackers to access and modify sensitive…. A patch is available.

How to fix or mitigate CVE-2026-15081?

Within 24 hours: identify all Drupal installations running Location Selector module versions 0.0.0 through 1.3.0 and document their current versions. Within 7 days: update the Location Selector module to the patched version per the vendor advisory on all affected instances and verify successful deployment. Within 30 days: review database access logs since module deployment for any anomalous SQL activity, and confirm no unauthorized data modifications occurred.

Location Selector CVE-2026-15081

EUVD-2026-43076 HIGH

SQL Injection (CWE-89)

2026-07-10 drupal

GHSA-rf2g-w6mf-4xjr

SQLi Drupal Location Selector

7.4

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Unauthenticated network-reachable SQLi (AV:N/PR:N/UI:N) with high confidentiality and integrity impact; AC:H retained because vendor scoring implies non-trivial preconditions, and A:N as injection does not inherently deny service.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 19:32 vuln.today

CVSS changed

Jul 13, 2026 - 19:22 NVD

7.4 (HIGH)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:46 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:46 cve.org

HIGH 7.4

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.

AnalysisAI

SQL injection in the Drupal Location Selector contributed module (all releases from 0.0.0 up to and including 1.3.0) lets remote attackers inject arbitrary SQL through improperly neutralized input, exposing and modifying database contents. The CVSS 3.1 base score is 7.4 with a network vector but high attack complexity, and the affected products confirm the Drupal 'location_selector' contrib module rather than Drupal core. There is no public exploit identified at time of analysis, and the EPSS score is low at 0.19% (9th percentile), indicating little near-term mass-exploitation pressure.

Technical ContextAI

The flaw is a CWE-89 SQL Injection: user-controllable input reaches a SQL query without proper neutralization of special elements, allowing an attacker to alter query structure. The affected component is a Drupal contributed module (CPE cpe:2.3:a:drupal:location_selector) that provides location/geographic selection functionality; such modules typically build database queries against Drupal's DBTNG/PDO layer, and SQLi here usually stems from concatenating request parameters into a query or misusing dynamic query placeholders instead of parameterized bindings. Because it is a contrib add-on, exposure exists only on Drupal sites that have explicitly installed and enabled the Location Selector module.

RemediationAI

Patch available per vendor advisory (https://www.drupal.org/sa-contrib-2026-072): upgrade the Location Selector module to the fixed release published after 1.3.0 as directed in the security advisory - the exact fixed version was not provided in this dataset, so confirm it on the drupal.org advisory before deploying rather than assuming a number. If immediate upgrade is not possible, compensating controls include disabling and uninstalling the Location Selector module if it is not business-critical (side effect: any location-selection features it provides stop working), and restricting network access to the pages/endpoints that invoke the module or placing a WAF rule in front of them to block SQL metacharacters in the relevant parameters (side effect: potential false positives on legitimate location input). Review database logs for anomalous queries against the module's tables as a detection measure.