Live › vulnerability › CVE-2026-87938
Go to dashboardThe Drupal CSP log module contains an SQL injection flaw that lets an attacker alter database queries. The sources do not say which input triggers it or what data an attacker can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Drupal sites that run the CSP log module at version 1.0.2 or earlier. The sources do not describe the exact configuration or the reachable endpoint, so whether an unauthenticated visitor can reach the flaw is unknown.
No product ranges from the sources yet.
drush pm:list --filter=csp_log or the Drupal extend page.1.0.2; the sources do not name the fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-87938")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.