Drupal wkhtmltopdf module all versions - Unauthenticated Other Vulnerability Type

Unauthenticated Other Vulnerability Type discovered by ? in WordPress Module wkhtmltopdf versions...

Drupal Gutenberg module < 2.13.0,3.0.0-3.0.4 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Mingsong in WordPress Module Gutenberg versions 2.13.0,3.0.0-3.0.4...

Drupal Block permissions module 1.0.0-1.1.9 - Administrator+ Broken Access Control vulnerability

Administrator+ Broken Access Control vulnerability discovered by Francesco Sardara in WordPress Module Block permissions versions 1.0.0-1.1.9...

The vulnerability of the /core/authorize.php file in the Drupal CMS system allows a hacker to disclose protected information.

The vulnerability of the /core/authorize.php file in the Drupal CMS system relates to the exposure of system data by unauthorized individuals in the controlled area. Exploiting this vulnerability could allow attackers to disclose protected information through the hashsalt parameter in the...

DRUPAL-CONTRIB-2024-044

This module enables users to remain logged in separately from session timeouts. The module doesn't sufficiently check a user's disabled status when validating cookies. This vulnerability is mitigated by the fact that an attacker must have an unexpired cookie from a previous successful login...

DRUPAL-CONTRIB-2024-043

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does not sufficiently migrate sessions before prompting for a second factor token. This vulnerability is mitigated by the fact that an attacker must fixat...

DRUPAL-CONTRIB-2024-042

This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions. The module doesn't sufficiently check revision access before rendering a diff report for 1 nodes or ...

PT-2025-2098 · Drupal · Drupal Facets

Name of the Vulnerable Software and Affected Versions: Drupal Facets versions 0.0.0 through 2.0.9 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can be exploited by a remote attacker to hijack a user's...

PT-2025-2094 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal Two-factor Authentication TFA versions 0.0.0 through 1.8.0 Description: The issue is related to incorrect session management in the Two-factor Authentication TFA module of the Drupal CMS system. This can allow a remote attacker to hija...

Drupal Persistent Login module < 1.8.0,2.2.0-2.2.1,2.0,2.1 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Geoff Appleby in WordPress Module Persistent Login versions 1.8.0,2.2.0-2.2.1,2.0,2.1...

PT-2025-2093 · Drupal · Diff

Name of the Vulnerable Software and Affected Versions: Diff versions 0.0.0 through 1.8.0 Description: The issue is related to an incorrect authorization vulnerability in the Diff module of the Drupal content management system. This vulnerability allows for functionality misuse. A remote attacker...

Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does not sufficiently migrate sessions before prompting for a second factor token. This vulnerability is mitigated by the fact that an attacker must fixat...

PT-2025-2095 · Drupal · Drupal Persistent Login

Name of the Vulnerable Software and Affected Versions: Drupal Persistent Login versions 0.0.0 through 1.8.0 Drupal Persistent Login versions 2.0. through 2.2.2 Description: The issue is related to insufficient session expiration in the Drupal Persistent Login module, allowing for forceful browsin...

Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions. The module doesn't sufficiently check revision access before rendering a diff report for 1 nodes or ...

VulnCheck KEV: CVE-2014-8379

Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...

Drupal Smart IP Ban module < 7.x-1.1 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Shawn Gants in WordPress Module Smart IP Ban versions 7.x-1.1...

PT-2025-2092 · Drupal · Drupal Cms +1

Name of the Vulnerable Software and Affected Versions: Drupal Smart IP Ban versions 7.X-1.0 through 7.X-1.0 Description: The issue is related to insufficient authorization mechanisms in the Smart IP Ban module for the Drupal CMS, allowing a remote attacker to view and modify settings. This can le...

Drupal File Entity (fieldable files) module < 7.x-2.39 - Authenticated Sensitive Data Exposure vulnerability

Authenticated Sensitive Data Exposure vulnerability discovered by Devin Zuczek in WordPress Module File Entity fieldable files versions 7.x-2.39...

CVE-2019-11358

...

Drupal Security Kit module < 2.0.3 - Unauthenticated Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack vulnerability discovered by b0lli in WordPress Module Security Kit versions 2.0.3...