CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

CVE-2025-31678

CVE-2025-31678 — Drupal AI Missing Authorization vulnerability affects Drupal AI (Artificial Intelligence) module. Affected versions are 0.0.0 through 1.0.2, with the root cause described as a missing authorization flaw that enables Forceful Browsing. The issue is characterized as an access bypas...

CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Missing Authorization vulnerability in Drupal AI Artificial Intelligence allows Forceful Browsing.This issue affects AI Artificial Intelligence: from 0.0.0 before 1.0.3...

CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

CVE-2025-31677

CVE-2025-31677 describes a CSRF vulnerability in Drupal AI (Artificial Intelligence) module affecting versions 1.0.0 through 1.0.1. Root cause: insufficient CSRF protection in the module, enabling unauthorized actions on behalf of authenticated users. Impact (per CVSS): high for confidentiality, ...

CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

CVE-2025-31676 Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3...

CVE-2025-31676

Drupal Email TFA (Drupal Email TFA module) is affected by a weak authentication vulnerability that enables brute-force attempts against the email-based second factor. The issue affects versions 0.0.0 through 2.0.2 and can allow bypass of the second factor, with exploitation described as a brute-f...

CVE-2025-31676 Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3...

CVE-2025-31676 Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3...

CVE-2025-31675 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...

CVE-2025-31675 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...

CVE-2025-31675 Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It al...

CVE-2025-31675

CVE-2025-31675 describes an XSS in Drupal core due to improper input neutralization during web page generation. Affected versions are Drupal core 8.0.0 up to 10.3.14, 10.4.0 up to 10.4.5, 11.0.0 up to 11.0.13, and 11.1.0 up to 11.1.5. The issue enables Cross-Site Scripting with network attack vec...

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2025-31674

The CVE-2025-31674 entry concerns Drupal core vulnerability: Improperly Controlled Modification of Dynamically-Determined Object Attributes, enabling Object Injection. Affected Drupal core versions are 8.0.0–before 10.3.13, 10.4.0–before 10.4.3, 11.0.0–before 11.0.12, and 11.1.0–before 11.1.3. Th...

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2025-31673 Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...