Drupal Material Admin 安全漏洞

Drupal Material Admin is a Drupal community admin theme for the Drupal backend based on the Google Material Design style, providing a modern and intuitive user interface. A security vulnerability exists in Drupal Material Admin. The vulnerability stems from a known security issue where an attack...

PT-2025-13841 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 1.0.0 through 1.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform actions on a user's behalf without their consent. This is a type of...

Drupal Cache Utility 跨站请求伪造漏洞

Drupal Cache Utility is a tool module for the Drupal community to manage and optimize the Drupal cache. A cross-site request forgery vulnerability exists in Drupal Cache Utility versions prior to 1.2.1 that stems from cross-site request forgery...

Drupal Ignition Error Pages 跨站脚本漏洞

Drupal Ignition Error Pages is a module of the Drupal community that provides custom error pages e.g. 404, 500, etc. to improve the user experience. A cross-site scripting vulnerability exists in Drupal Ignition Error Pages versions prior to 1.0.4, which stems from improper input neutralization a...

PT-2025-13843 · Drupal · Ignition Error Pages

Name of the Vulnerable Software and Affected Versions: Ignition Error Pages versions 0.0.0 through 1.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in Drupal Ignition Error Pages. This allows for...

PT-2025-13846 · Drupal · Drupal Google Tag

Name of the Vulnerable Software and Affected Versions: Drupal Google Tag versions 0.0.0 through 1.7.x Drupal Google Tag versions 2.0.0 through 2.0.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allow...

PT-2025-13839 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions 8.0.0 through 10.3.13 Drupal core versions 10.4.0 through 10.4.4 Drupal core versions 11.0.0 through 11.0.12 Drupal core versions 11.1.0 through 11.1.4 Description: The issue affects Drupal core, allowing Cross-Site...

PT-2025-13863 · Drupal · Drupal Ai

Name of the Vulnerable Software and Affected Versions: Drupal AI Artificial Intelligence versions 0.0.0 through 1.0.4 Description: The issue is related to an OS Command Injection vulnerability due to improper neutralization of special elements used in an OS command. This allows for OS Command...

Drupal Email TFA 安全漏洞

Drupal Email TFA is a Drupal community module that provides email-based two-factor authentication functionality for Drupal. A security vulnerability exists in Drupal Email TFA versions prior to 2.0.3, which stems from weak authentication and could lead to brute force exploits...

Drupal Two-factor Authentication 安全漏洞

Drupal Two-factor Authentication is a module for the Drupal community. A security vulnerability exists in Drupal Two-factor Authentication versions prior to 1.10.0, which stems from incorrect authorization and could lead to forced browsing...

Drupal Google Tag 跨站请求伪造漏洞

Drupal Google Tag is a Drupal community module for integrating Google Tag Manager in Drupal websites. A cross-site request forgery vulnerability exists in Drupal Google Tag versions prior to 1.8.0 and versions prior to 2.0.0 through 2.0.8 that stems from cross-site request forgery...

PT-2025-13864 · Drupal · Drupal Two-Factor Authentication

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.10.0 Description: The issue is related to an Incorrect Authorization vulnerability in the Drupal Two-factor Authentication TFA module, allowing Forceful Browsing. Recommendations:...

PT-2025-13851 · Drupal · Drupal Spamspan Filter

Name of the Vulnerable Software and Affected Versions: Drupal SpamSpan filter versions 0.0.0 through 3.2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in the Drupal SpamSpan filter. This allows for...

PT-2025-13840 · Drupal · Drupal Email Tfa

Name of the Vulnerable Software and Affected Versions: Drupal Email TFA versions 0.0.0 through 2.0.2 Description: The issue is related to weak authentication in Drupal Email TFA, allowing brute force attacks. Recommendations: For versions 0.0.0 through 2.0.2, update to version 2.0.3 or later to...

Drupal AI 操作系统命令注入漏洞

Drupal AI is a module or solution for the Drupal community that integrates artificial intelligence capabilities. An operating system command injection vulnerability exists in Drupal AI versions prior to 1.0.5, which stems from improper neutralization of a special element and could lead to os...

Drupal Google Tag 跨站脚本漏洞

Drupal Google Tag is a Drupal community module for integrating Google Tag Manager in Drupal sites. A cross-site scripting vulnerability exists in Drupal Google Tag versions prior to 1.8.0 and versions prior to 2.0.0 through 2.0.8, which stems from improper input neutralization and could lead to...

PT-2025-13848 · Drupal · Drupal Oauth2 Client

Name of the Vulnerable Software and Affected Versions: Drupal OAuth2 Client versions 0.0.0 through 4.1.2 Description: A Cross-Site Request Forgery CSRF issue affects the Drupal OAuth2 Client, allowing unauthorized actions to be performed on behalf of the user. This issue may be exploited by an...

PT-2025-13854 · Drupal · Drupal Cache Utility

Name of the Vulnerable Software and Affected Versions: Drupal Cache Utility versions 0.0.0 through 1.2.0 Description: A Cross-Site Request Forgery CSRF issue affects the Drupal Cache Utility, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 0.0.0...

Drupal RapiDoc OAS Field Formatter 跨站脚本漏洞

Drupal RapiDoc OAS Field Formatter is a Drupal community field formatter for Drupal. A cross-site scripting vulnerability exists in Drupal RapiDoc OAS Field Formatter versions prior to 1.0.1, which stems from improper input neutralization and could lead to a cross-site scripting attack...

PT-2025-13836 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal core versions 8.0.0 through 10.3.12 Drupal core versions 10.4.0 through 10.4.2 Drupal core versions 11.0.0 through 11.0.11 Drupal core versions 11.1.0 through 11.1.2 Description: The issue affects Drupal core, allowing Cross-Site...