6.5
/ 10
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
This issue affects Drupal core: from 8.9.0 before 10.4.10, from 10.5.0 before 10.5.10, from 10.6.0 before 10.6.9, from 11.0.0 before 11.1.10, from 11.2.0 before 11.2.12, from 11.3.0 before 11.3.10.
Basic Information
ID
CVE-2026-9082
Source
drupal
Published
May 20, 2026 at 18:20
Modified
May 20, 2026 at 19:37
Affected Product
Vendor
Drupal
Product
Drupal core
Version
8.9.0
Affected Versions
Drupal Drupal core 8.9.0
Drupal Drupal core 10.5.0
Drupal Drupal core 10.6.0
Drupal Drupal core 11.0.0
Drupal Drupal core 11.2.0
Drupal Drupal core 11.3.0
Drupal Drupal core 10.5.0
Drupal Drupal core 10.6.0
Drupal Drupal core 11.0.0
Drupal Drupal core 11.2.0
Drupal Drupal core 11.3.0