What’s Vulnerable › Vulnerabilities

CVE-2016-3187

• Severity: high (CVSS 7.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-04-08 · updated 2026-06-17
• Weakness: CWE-264

Description

The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to modify the REQUEST superglobal array, and consequently have unspecified impact, via a base64-encoded pp parameter.

Affected products

• Prepopulate Project Prepopulate: 7.x-2.0, 7.x-2.x-dev

References

• http://cgit.drupalcode.org/prepopulate/commit/prepopulate.module?id=16cdb63cc3b256dd785e029ec17f92ddf80cc443
• https://www.drupal.org/node/2679215
• https://www.drupal.org/node/2679503
• http://cgit.drupalcode.org/prepopulate/commit/prepopulate.module?id=16cdb63cc3b256dd785e029ec17f92ddf80cc443
• https://www.drupal.org/node/2679215
• https://www.drupal.org/node/2679503

Get alerted when CVE-2016-3187 or the next vulnerability affects your stack