CVE-2014-3704
Public exploit
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
Max CVSS
7.5
EPSS Score
97.53%
Published
2014-10-16
Updated
2021-09-29
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
Max CVSS
7.5
EPSS Score
0.69%
Published
2014-01-24
Updated
2014-02-21
2 vulnerabilities found