CVE-2012-1641

The finder_import function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import.

• CWE-264

• https://drupal.org/node/1432318Patch
• https://drupal.org/node/1432320Patch
• https://drupalcode.org/project/finder.git/commit/bc0cc82
• https://secunia.com/advisories/47915Vendor Advisory
• https://secunia.com/advisories/47943Vendor Advisory
• https://www.madirish.net/content/drupal-finder-6x-19-xss-and-remote-code-execution-vulnerabilitiesExploit
• https://www.openwall.com/lists/oss-security/2012/03/16/9
• https://www.openwall.com/lists/oss-security/2012/03/19/9
• https://www.openwall.com/lists/oss-security/2012/04/07/1
• https://www.osvdb.org/79014
• https://drupal.org/node/1432970Vendor Advisory
• https://drupal.org/node/1432318Patch
• https://drupal.org/node/1432320Patch
• https://drupalcode.org/project/finder.git/commit/bc0cc82
• https://secunia.com/advisories/47915Vendor Advisory
• https://secunia.com/advisories/47943Vendor Advisory
• https://www.madirish.net/content/drupal-finder-6x-19-xss-and-remote-code-execution-vulnerabilitiesExploit
• https://www.openwall.com/lists/oss-security/2012/03/16/9
• https://www.openwall.com/lists/oss-security/2012/03/19/9
• https://www.openwall.com/lists/oss-security/2012/04/07/1
• https://www.osvdb.org/79014
• https://drupal.org/node/1432970Vendor Advisory

Published

Aug 28, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-1635The hook_node_access function in the revisioning module 7.x-…
• CVE-2012-1636Cross-site request forgery (CSRF) vulnerability in the stick…
• CVE-2012-1637Cross-site scripting vulnerability (XSS) in the Quick Tabs m…4.8
• CVE-2012-1638SQL injection vulnerability in the Search Autocomplete modul…
• CVE-2012-1639Multiple cross-site scripting (XSS) vulnerabilities in produ…
• CVE-2012-1640Multiple cross-site scripting (XSS) vulnerabilities in the M…
• CVE-2012-1642includes/linkchecker.pages.inc in the Link checker module 6.…
• CVE-2012-1643The Faster Permissions module 7.x-2.x before 7.x-1.2 for Dru…
• CVE-2012-1644The Organic Groups (OG) Vocabulary module 6.x-1.x before 6.x…
• CVE-2012-1645The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running …
• CVE-2012-1646Multiple cross-site scripting (XSS) vulnerabilities in the F…
• CVE-2012-1647Multiple cross-site scripting (XSS) vulnerabilities in the "…