CVE-2013-4446

The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection.

• CWE-94

• http://drupalcode.org/project/context.git/commitdiff/63ef4d9Patch
• http://drupalcode.org/project/context.git/commitdiff/d7b4afaPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html
• https://drupal.org/node/2112785Patch
• https://drupal.org/node/2112791Patch
• https://drupal.org/node/2113317Patch, Vendor Advisory
• http://drupalcode.org/project/context.git/commitdiff/63ef4d9Patch
• http://drupalcode.org/project/context.git/commitdiff/d7b4afaPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html
• https://drupal.org/node/2112785Patch
• https://drupal.org/node/2112791Patch
• https://drupal.org/node/2113317Patch, Vendor Advisory

Published

Dec 7, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4440Password Generator (aka Pwgen) before 2.07 generates weak no…
• CVE-2013-4441The Phonemes mode in Pwgen 2.06 generates predictable passwo…9.8
• CVE-2013-4442Password Generator (aka Pwgen) before 2.07 uses weak pseudo …
• CVE-2013-4443Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4444Unrestricted file upload vulnerability in Apache Tomcat 7.x …
• CVE-2013-4445The json rendering functionality in the Context module 6.x-2…
• CVE-2013-4447Cross-site scripting (XSS) vulnerability in the API in the S…
• CVE-2013-4448Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-4449The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does…
• CVE-2013-4450The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x b…
• CVE-2013-4451gitolite commit fa06a34 through 3.5.3 might allow attackers …
• CVE-2013-4452Red Hat JBoss Operations Network 3.1.2 uses world-readable p…