VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 03:40 UTC

CVE-2019-6340

Read full description

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)

CVSS 8.1 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.7/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.1: +1.21
Fresh EPSS: 92.02%: +0.46

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 7 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Help Net Security

Press · 16 Apr 2021, 07:00 · Infection Monkey: Open source tool allows zero trust assessment of AWS environments - Help Net Security

Unit 42

Press · 12 Apr 2021, 07:00 · Network Attack Trends: Internet of Threats (November 2020-January 2021) - Unit 42

Google Cloud

Press · 13 Apr 2020, 07:00 · Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two - Google Cloud

www.trendmicro.com

Press · 27 Feb 2019, 08:00 · Drupal Vulnerability Can Be Exploited for RCE Attacks - www.trendmicro.com

WeLiveSecurity

Press · 27 Feb 2019, 08:00 · ‘Highly critical’ bug exposes unpatched Drupal sites to attacks - WeLiveSecurity

See all 7 source documents

www.trendmicro.com

Press · 27 Feb 2019, 08:00 · Drupal Vulnerability Can Be Exploited for RCE Attacks - www.trendmicro.com

Rapid7

Press · 21 Feb 2019, 08:00 · CVE-2019-6340 Drupal Core Remote Code Execution Explained - Rapid7

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:12). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

See 2 repos with metrics

Repository	Stars	Forks	Language	Updated
zhzyker/exphub	4,293	1,078	Python	04 Apr 2021, 09:13
oways/CVE-2019-6340	11	8	Python	25 Feb 2019, 08:57

Public exploit evidence

exploitdb #46452 2019-02-23
exploitdb #46459 2019-02-25
exploitdb #46510 2019-03-07

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.1; EPSS 92.0%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction, additional attack conditions.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:58:10.185247+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

First press mention

21 Feb 2019, 08:00

Published

21 Feb 2019, 21:00

Latest press mention

16 Apr 2021, 07:00

Added to the CISA KEV catalog

25 Mar 2022, 00:00

Score calculated

05 Nov 2026, 13:58

PoCs on GitHub

3 repositories