CVE-2015-8761

9.0 criticalEPSS 1.5%

Critical (9.0) in values project values. EPSS 1.5% chance of exploitation in the next 30 days.

The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.

Severity

CVSS 3.0

9.0 critical

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 73% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2016-01-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

values_project:values

References

http://cgit.drupalcode.org/values/commit/?id=5942ee9
http://www.securityfocus.com/bid/79656
https://www.drupal.org/node/2622534
https://www.drupal.org/node/2636344
http://cgit.drupalcode.org/values/commit/?id=5942ee9

Check your stack JSON