SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2019-6340

HIGH · CVSS 8.1 EPSS 92.02% CISA KEV · Actively Exploited Public Exploit

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2019-02-21 · Last synced 2026-08-04

CyberRota Analysis

This is a high severity vulnerability with a CVSS score of 8.1. It is listed in CISA's Known Exploited Vulnerabilities catalog, indicating confirmed active exploitation in the wild. Public exploit code or proof-of-concept references have been detected in its references. Its EPSS score suggests a 92.0% probability of exploitation in the next 30 days.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
code execution

Note: these links are listed for security research and verification purposes only.

CISA KEV Details

Status: This CVE is listed in CISA's Known Exploited Vulnerabilities catalog.

Ransomware use: Unknown

Added to KEV: 2022-03-25

Required action: Apply updates per vendor instructions.

CVE
CVE-2019-6340
Severity
HIGH
CVSS
8.1
EPSS
92.02%

Original NVD Description

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

Related CVEs

Other vulnerabilities affecting the same vendor(s)