Drupal Core 过度迭代漏洞 可致拒绝服务

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.drupal.org/sa-core-2025-005
• https://www.invicti.com/web-application-vulnerabilities/drupal-core-8-8-0-denial-of-service-8-8-0
• https://www.acunetix.com/vulnerabilities/web/drupal-core-7-x-denial-of-service-7-0-7-19/
• https://advisories.gitlab.com/composer/drupal/core/GMS-2024-214/
• https://www.drupal.org/forum/newsletters/security-advisories-for-drupal-core/2014-08-06/sa-core-2014-004-drupal-core-denial
• https://www.cybersecurity-help.cz/vdb/SB2024011623
• https://www.acunetix.com/vulnerabilities/web/envoy-proxy-excessive-iteration-vulnerability-cve-2021-39204/

Related Vulnerabilities

• PoCCVE-2026-10768: Drupal LocalGov Workflows < 1.6.0 - Information Disclosure
• PoCCVE-2026-9082: Drupal Core - Anonymous SQL Injection via PostgreSQL Entity Query
• Drupal core /jsonapi/node/article SQL 注入漏洞（CVE-2026-9082）
• PoCdrupal-source-code-disclosure: Drupal - Source Code Disclosure
• PoCdrupal-directory-listing: Drupal Directory Listing
• PoCCVE-2021-33829: Drupal 7 CKEditor XSS
• CVE-2019-6340: Drupal 8 core RESTful Web Services RCE
• PoCCVE-2014-3704: Drupal SQL Injection
• PoCCVE-2018-7600: Drupal - Remote Code Execution
• PoCCVE-2018-7602: Drupal - Remote Code Execution
• PoCCVE-2018-9205: Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion
• PoCCVE-2019-6340: Drupal - Remote Code Execution
• PoCCVE-2024-45440: Drupal 11.x-dev - Full Path Disclosure