CVE-2026-9726

EPSS 0.31%
Veröffentlicht 10.07.2026 20:56:18
Zuletzt bearbeitet 06.08.2026 18:28:34
CVE-Watchlists
Login
Unerledigt
Login

Drupal AlternativeCommerce (Basket) - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2026-038

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal AlternativeCommerce (Basket) allows Object Injection. This issue affects Drupal AlternativeCommerce (Basket) versions: from 0.0.0 to 2.1.17.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

NVD 1 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Alternativecommerce ≫ Alternativecommerce SwPlatformdrupal Version < 2.1.17

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.31%	0.233

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

https://www.drupal.org/sa-contrib-2026-038

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-9726

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-9726

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-9726

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-9726