CVE-2026-87938CWE-89sql-injection

CVE-2026-87938

published October 22, 2026

CVSS
—
EPSS
0%
Percentile
5.8
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-10-22T06:17Z
References (1)
https://www.drupal.org/sa-contrib-2026-136 · [email protected]
EPSS history
Timeline
  • 23 OCT 04:09Z
    EPSS moved — → 0%
    epss
  • 22 OCT 01:22Z
    CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
    cvelistv5
  • 22 OCT 01:22Z
    CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
    cvelistv5