Anna Kalata

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** An attacker with appropriate JSON:API write permissions could potentially inject a malicious payload in certain rare circumstances, leading to PHP Object Injection. PHP Object Injection occurs when untrusted input is used to instantiate objects, which can allow an attacker to execute arbitrary code or manipulate application logic. This issue is exploitable only if a site uses an entity reference field type that stores a serialized property and has enabled write access for JSON:API, which is read-only by default. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal core (affected versions not specified) **Description** Drupal core contains a gadget chain, which is a sequence of existing code fragments that can be leveraged during the deserialization of untrusted data. While this issue is not directly exploitable, it can serve as a vector to achieve remote code execution or SQL injection if a separate vulnerability allows an attacker to pass unsafe input to the `unserialize()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Drupal Core versions 8.9.0 through 10.4.9 Drupal Core versions 10.5.0 through 10.5.9 Drupal Core versions 10.6.0 through 10.6.8 Drupal Core versions 11.0.0 through 11.1.9 Drupal Core versions 11.2.0 through 11.2.11 Drupal Core versions 11.3.0 through 11.3.9 **Description** An unauthenticated SQL injection flaw exists in the database abstraction API of Drupal Core, specifically within the PostgreSQL `EntityQuery` condition handler. The issue occurs when attacker-controlled PHP array keys, such as `filter[...][condition][value][malicious key]`, are concatenated directly into SQL identifiers without proper sanitization or escaping. This allows remote, anonymous users to execute arbitrary SQL commands on sites using PostgreSQL databases. Potential impacts include full database access, exfiltration of sensitive data and password hashes, privilege escalation to Administrator, and remote code execution (RCE) if database permissions are misconfigured (e.g., allowing `COPY FROM PROGRAM`). Real-world exploitation is active, with over 15,000 attack probes detected across approximately 6,000 sites in 65 countries, heavily targeting gaming and financial services. **Recommendations** Update Drupal Core to version 10.4.10. Update Drupal Core to version 10.5.10. Update Drupal Core to version 10.6.9. Update Drupal Core to version 11.1.10. Update Drupal Core to version 11.2.12. Update Drupal Core to version 11.3.10. Restrict user roles that have the ability to update Twig templates via Views or contributed modules. Route production traffic through a Web Application Firewall (WAF) to filter malicious nested array payload signatures. Review PostgreSQL and WAF logs for unusual anonymous user queries or structural query modifications.

**Name of the Vulnerable Software and Affected Versions** Drupal versions prior to 10.5.9 Drupal versions prior to 10.6.7 Drupal versions prior to 11.2.11 Drupal versions prior to 11.3.7 **Description** Drupal core's jQuery integration for AJAX modal dialog boxes does not sufficiently sanitize certain options, which can lead to cross-site scripting (XSS), a flaw where malicious scripts are injected into trusted websites. **Recommendations** Update to version 10.5.9 Update to version 10.6.7 Update to version 11.2.11 Update to version 11.3.7

**Name of the Vulnerable Software and Affected Versions** Drupal versions 8.0.0 through 10.4.9 Drupal versions 10.5.0 through 10.5.6 Drupal versions 11.0.0 through 11.1.9 Drupal versions 11.2.0 through 11.2.7 **Description** Drupal core contains an improperly controlled modification of dynamically-determined object attributes, leading to Object Injection. This allows for potential manipulation of objects within the system. **Recommendations** Update Drupal core to version 10.4.9 or later. Update Drupal core to version 10.5.6 or later. Update Drupal core to version 11.1.9 or later. Update Drupal core to version 11.2.8 or later.

Name of the Vulnerable Software and Affected Versions: Drupal Layout Builder Advanced Permissions versions 0.0.0 through 2.1.9 Description: Missing authorization allows forceful browsing in Drupal Layout Builder Advanced Permissions. Recommendations: Update to version 2.2.0 or later.