
Drupal fixes highly critical flaw, but offers no details - mediawatch
https://www.itwire.com/open-source/82261-drupal-fixes-highly-critical-flaw-but-offers-no-details.html
======
tyingq
Ah wow, that is really bad. RCE via multiple vectors (http post, cookies, url
params) just by using a leading '#' char.

