https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:25:58 +0000 https://cve.radiocsirt.org/vuln/drupal-contrib-2026-038 <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/basket</p> <p>The Basket module enables e-commerce and checkout functionality for Drupal sites.</p> <p>The module does not sufficiently sanitize user-supplied data before passing it to PHP&#39;s unserialize().</p> <p>An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution.</p> <p><strong>Affected:</strong> Packagist:https://packages.drupal.org/8: drupal/basket</p> <p>The Basket module enables e-commerce and checkout functionality for Drupal sites.</p> <p>The module does not sufficiently sanitize user-supplied data before passing it to PHP&#39;s unserialize().</p> <p>An attacker can supply a crafted payload and trigger PHP Object Injection. If a viable gadget chain exists in the site codebase or installed dependencies, this can result in arbitrary PHP code execution.</p> https://cve.radiocsirt.org/vuln/drupal-contrib-2026-038 https://cve.radiocsirt.org/vuln/euvd-2026-336489 EUVD-2026-336489 https://cve.radiocsirt.org/vuln/euvd-2026-336489 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9726 <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.</p> <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9726 https://cve.radiocsirt.org/vuln/ghsa-ggc6-38jq-q957 <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.</p> <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.</p> https://cve.radiocsirt.org/vuln/ghsa-ggc6-38jq-q957 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1702 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Drupal-Modul &#34;AlternativeCommerce&#34; (Basket) ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle im Drupal-Modul &#34;AlternativeCommerce&#34; (Basket) ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1702