CVE-2026-15081

EUVD-2026-43076
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Location Selector allows SQL Injection. This issue affects Location Selector versions: from 0.0.0 to 1.3.0.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 25.99%
Affected Products (NVD)
VendorProductVersion
handkerchieflocation_selector
𝑥
< 1.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.drupal.org/sa-contrib-2026-072