Back to the CVE list
CVE-2018-7600 CISA KEV · Actively exploitedLinked to ransomware

drupal: Unsanitized requests allow remote attackers to execute arbitrary code

CVSS score

9.8

EPSS probability

%100.0

Risk score

19.6

Published

8 y ago

OverviewPublic Exploits (13)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
CyberCTF/vulhub-drupal-cve-2018-7600
GitHub

Vulhub drupal/CVE-2018-7600: Drupalgeddon 2 on Drupal 8.5.0, run with Isoloom

Public PoCSource updated: 10.10.2026 21:42:31
G
K52-ai/CVE-2018-7600
GitHub

CVE-2018-7600 (Drupalgeddon2) — Drupal RCE exploit tool. Standalone Python PoC for authorized security testing. CVSS 9.8 Critical. by K52-ai.

Public PoCSource updated: 04.10.2026 17:05:49
G
Aihikk/DC-1_Vulnhub_Walkthrough
GitHub

VulnHub DC-1 boot2root — unauthenticated RCE via Drupalgeddon2 (CVE-2018-7600) to SUID find privilege escalation, with severity-rated findings and remediation.

Public PoCSource updated: 06.10.2026 14:33:38
G
elkhaoudari/CVE-2018-7600-PoC
GitHub

elkhaoudari/CVE-2018-7600-PoC

Public PoCSource updated: 30.09.2026 14:08:46
G
Shams-Ul-Mehmood/CVE-2018-7600-Drupalgeddon2-RCE
GitHub

Shams-Ul-Mehmood/CVE-2018-7600-Drupalgeddon2-RCE

Public PoCSource updated: 06.08.2026 13:02:19
G
Prapul1/VulnHub-DC1-Writeup
GitHub

VulnHub DC-1 boot-to-root — exploiting CVE-2018-7600 (Drupalgeddon2) for RCE, extracting DB credentials from settings.php, forging admin password hash, and escalating to root via SUID find.

Public PoCSource updated: 14.08.2026 10:05:37
G
muhammedkayag/CVE-2018-7600
GitHub

PoC of CVE-2018-7600

Public PoCSource updated: 19.06.2026 08:24:36
G
nayem-m/drupalgeddon2-cli
GitHub

CLI rewrite of the Drupalgeddon2 (CVE-2018-7600) PoC — for authorised testing/education

Public PoCSource updated: 11.06.2026 05:16:11
G
Dungsocool/CVE-2018-7600
GitHub

Dungsocool/CVE-2018-7600

Public PoCSource updated: 30.05.2026 10:03:18
E
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)
Exploit-DB

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (Metasploit)

Exploit referenceSource updated: 17.04.2018 00:00:00
E
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
Exploit-DB

Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution

Exploit referenceSource updated: 13.04.2018 00:00:00
E
Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)
Exploit-DB

Drupal < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution (PoC)

Exploit referenceSource updated: 13.04.2018 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-7600.yaml
Nuclei

Nuclei: Drupal - Remote Code Execution

Exploit reference

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.enginteksut.com.tr/api/v1/intel/cves/CVE-2018-7600"