VulnerabilityAnalyzed

CVE-2026-13242

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection.

MEDIUM 6.5EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Geolocation Field allows SQL Injection. This issue affects Geolocation Field versions: from 0.0.0 to 3.15.0.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.28% probability · 20th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: dopry/geolocation field
Source: mlhess@drupal.org

References

https://www.drupal.org/sa-contrib-2026-062Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.